How can I search for the contents of a table inside of another table?

[fre]

Hi and thanks for reading in advance,

I have two tables:

1. events for status=50* on a /submissions URL endpoint, let's call this errors, and
2. events for status=200 on a /submissions URL endpoint, let's call this successes

I want to find out which events occur in the errors table, but not the successes table.

The particular context is we had an outage, and I'm trying to discover which events were successfully submitted at a later date, and mainly: which events haven't been submitted since the outage.

How would you go about this?

Thanks,
fre

[DalJeanis · Accepted solution]

It's going to be something like this, then...

 index=foo  status=50* OR status=200
 | fields status whateverfieldsareuniqueeventid
 | eval Result=if(status=200,"Success","Error")
 | stats values(Result) by whateverfieldsareuniqueeventid
 | where mvcount(Result)=1 AND Result="Error"

[somesoni2]

A sudo code will be like this (RESULT_TYPE_Identifier is field which differentiates errors with success)

(BASE SEARCH ERRORS) OR (BASE SEARCH SUCCESS) 
| eval RESULT_TYPE_Identifier=if(like(status,"50%"),"Error","Success")
| stats values(RESULT_TYPE_Identifier) as RESULT_TYPE_Identifier by eventIdentifier_field(s)
| where mvcount(RESULT_TYPE_Identifier)=1 AND RESULT_TYPE_Identifier="Error"

We can give you better suggestions if you could share your actual queries..

[fre]

Thanks somesoni2,
queries are quite simple, basically:

 status=50*

and

 status=200

[somesoni2]

Do you have any unique identifier in your logs, kind of transaction id or event id?