Excluding logs with specific keywords from dashboards

[kp2]

Hello, 
I have application which ends specific kind of log. Every log have a jobId field and additional information" returned: 1" or "returned: 0". For one jobId program can return a lot of "returned: 1" and only one "returned: 0" logs. I want to get dashboard for daily count of jobId, but I want to exclude jobId number, when one of logs contain "returned: 1". I write something like that:
$env$ $project$ "jobId" AND NOT "returned: 0" | timechart span=24h dc(jobId)

but this only exclude logs, where is only "returned : 0" for one jobId.

Is there possibility to get this dashboard?

[ITWhisperer]

If I have understood your requirement, you want a count of jobs which have only ever returned 0 and never returned 1?

If this is the case, how do you set your time frame to ensure the just before your earliest time, a job hasn't just returned 1?

[kp2]

Yes, I  want a count of jobs which have only ever returned 0 and never returned 1. 
There is no possibility to return 1 and next return 0. There is only case, when I have several jobs with 0 and eventually returned 1 as the last one. So I think, that time frame is unnecessary.

[ITWhisperer]

There is always a timeframe, even if it is "all time" (which even then really means all the events currently indexed i.e. it does not include events which had past the expiry time of their buckets.

If you want jobs which have "never" returned 1 in any event you have available, you may still have to search all your events just in case there is an event for the job with returned 1.

As it stands, your requirement is not precise enough to be able to determine if a solution is possible.

[kp2]

I know that I must search for "returned 1" but I don't know how to do it. To sum up, I must check if some jobId have "returned 0" and the same jobId not "returned 1". But I don't know how to do it.

[ITWhisperer]

Assuming you have a field called returned that either holds 1 or 0, you could do this

| eventstats values(returned) as returned by jobId
| where mvcount(returned) == 1 AND returned = 0
| timechart span=24h dc(jobId)