Filtering results based on subsequent events?

[Wilcooley]

Sorry for the horrible title but I cannot think of a good, succinct description of the problem I am trying to solve (which has also made searching for existing answer difficult).

I am trying to build a table of hosts on where a tool is failing to run; that's easy enough:

 hostA tool failed to run
 hostB tool failed to run
 ...

I build the table with:

 "failed to run" | dedup host | table host

But what I've really got is this:

time000 hostA tool failed to run
time001 hostB tool failed to run
 ...
time005 hostA tool run successfully
 ...

So what I'd like to do is exclude hostA, since clearly it is not longer failing, but I am not even sure how to approach this.

Thanks!

[Wilcooley · Accepted solution]

Ok, I figured this out myself; the trick is to search for both the success and failure messages, dedup based on the host so you get the last of the two messages and then filter those results for the failure message. Something like this:

"failed to run" OR "ran successfully" | dedup host | search "failed to run" |table host