Filtering logfiles showing one error log for every row

[apmcharter]

Hello,

I need help in creating a search query to filter info showing just our logfile with same error line for all rows.

This error code also appear in other days on the same logfile but I don't want that to show up.

If no other info except this error shows up in the logfile, our app is failing and I need to catch that.

c.q.s.c.StoreHourSyncRestController : *** Sync Busy ***

Please assist.

Thank you!

Andie Medalla

[richgalloway]

If I understand the requirements correctly, this query will only return events that do not match the sample text.

index=foo NOT "*c.q.s.c.StoreHourSyncRestController*"
| regex _raw!="c\.q\.s\.c\.StoreHourSyncRestController : \*\*\* Sync Busy \*\*\*"
| appendpipe [stats count | eval _raw="App is failing!" | where count=0]