Extracting record which is not success after few retry.

[Nilesh067]

I have below log message :
basically it is for creating customer record and if we got error the we are retrying for 5 times to get succeed. 


log message-------------



Error while creating record  for customer id : 94ABGH0048

Error while creating record  for customer id : 94ABGH0048

Successfully created record for customer id : 94ABGH0048

Error while creating record  for customer id : 902SDKK720

Successfully created record for customer id : 945TTFK048

can i get those customer id for which record not created Successfully ?

according to above log message output should be  "902SDKK720"

[kennetkline]

1.  extract the last status code by customer id   I wasn't sure field in your search so used _raw

| rex field=_raw "^(?<statuscode>[a-zA-Z]+)\s|customer\sid\s+:\s(?<customerid>[0-9A-Z]+)"
| stats last(statuscode) by customerid

2.  if understanding you correctly; you wanted any customer id's (where the last code is a failure, didn't aks to validate file 5 events but could do that too.

your search  blah, blah, blah...
| rex field=_raw "^(?<statuscode>[a-zA-Z]+)\s|customer\sid\s+:\s(?<customerid>[0-9A-Z]+)"
| stats last(statuscode) by customerid
| where statuscode = "Error"
| table customerid