How to search and calculate stats on the outages for business transactions?

[hereissat]

Hello

I'm interested in finding the outages for my business service. Here is how it works:

• I have a log file that logs the request / response for a web service. These request / response messages have a field called correlationID
• I have already correlated the request / response by the correlation ID (via stats)
• Based on this correlation, I derive a field called "status" as follows:
• If the response contains the word "Tech Exception", status="Technical Exception"
• If the response contains the word successful, status="Successful"

Here is how my stats output table looks:

What I would like to get is:
- Every 2 consecutive "Technical Exceptions" is the start of an outage.
- The outage ends only after the status becomes Successful

I would like to calculate the outages for my service.
Could someone please help me derive a search for this problem?

Thanks for your time.

Regards
Sathish

[alacercogitatus]

A transaction might work, I haven't tested this theory yet.

... <your_search_to_make_table> | transaction startswith="status=Technical*" endswith="Successful" | where eventcount > 2

This should return all of the events that start with Technical Exception and ends with Successful, and then filters out those to only have event count more than 2 ( 2 TE and 1 Successful). As an added bonus, you will have duration as a field, which would show you the duration in seconds of the outage.