How to exclude the rows by comparing the results ?

[georgear7]

I have a below table which shows status of package in each host. Normally 2 kinds of packages are there, one with 'bw' word in it and other without 'bw'. In this case, i only care about 'bw' package'. If my 'bw' package status is 'Successful' anywhere, i just want to ignore the other bw rows which has different status(eg. No_File). Is there any way to do this?

Highlighted the unwanted rows in yellow color.

Expected Output:

[493669]

@georgear7  Try below search which will search Package containing "bw" and status as "successful".

|search Package="*bw*" AND status="Successful"

Try below search with dummy data-

|makeresults|eval Package="a.bw.int-7", status="Successful"
|append[|makeresults|eval Package="a.bw.int-7" , status="No_File"]
|append[|makeresults|eval Package="app.int-4" , status="Successful"]
|search Package="*bw*" AND status="Successful"

If it helps upvote will be appreciated!

[georgear7]

@493669 Thanks for your reply. I missed to mention some points. I need both 'bw' and without 'bw' package in the final output but i want this comparison to be done only for 'bw' package. For rest, we can keep as it is. Here my requirement is whenever 'bw' package status is "Successful", i want to ignore rest of the rows for that particular package. Also, please note that, my 'bw' package may not have 'Successful' status as well. So in that case i want to keep all the rows.

In simple, compare the rows by package and if it's 'Succesful' anywhere, ignore the rest of the rows. If it's not success, keep all the rows.

[georgear7]

Can anyone help me on this ?