How to filter logs with different and same fields?

[nmayafit]

Hi. Subject is confusing so here goes. I have 3 log lines:

org=A Status=Success

org=A Status=Fail

org=B Status=Success

I would like to get stats for orgs that have Status=Success, but not if those orgs have even one log where Status=Fail.

I tried to filter in the search query (but then, I get the line where org=A Status=Success) and in a WHERE clause, with no luck. I'm trying to find the right method to do this kind of filtering.

Thanks!

[ITWhisperer]

| stats values(Status) as Status by org
| where NOT Status="Fail"

[PickleRick]

I assume these are three separate events.  You can't filter one event based on value of another event. If you want just a summary of your orgs do something like that

<your base search>
| stats values(Status) by org
| where NOT Status="Fail"

If you want full events use eventstats instead of stats but be aware that eventstats is limited by resource constraints so may not work well on big datasets.

[nmayafit]

Thanks.

I tried that already, but it still shows the results in the stats.

[PickleRick]

That's why I said - if you're ok with just the aggregation, use simple stats command. If you want to retain the original events, use eventstats (with the same syntax). Just be warned about the possible performance issues.

[nmayafit]

I don't need the original events, so I use stats, but it still shows as a line with this values

[PickleRick]

Right. Forgot to rename the resulting field with stats. See @ITWhisperer 's answer. It is conceptually the same as mine, it's just that he didn't forget to alias the field 🙂 His solution should work. Mine should also work if you replaced the where condition with:

| where NOT 'values(Status)'="Fail"

[nmayafit]

I tried his and yours with no luck. Lines with the specific attributes still show.

[ITWhisperer]

It seems like the information you have provided isn't sufficiently accurate for our suggested solutions to work. Please share more accurate representations of your raw events, preferably in a code block </> to prevent information being lost due to formatting.