Search doesn't show results if for the same node are present two type of alarms

[ngerosa]

Hello,
I have a query that extract some type of alarms divided by NODE.
These are the columns of the query:

_time ALARM NODE

If for the same NODE is present ALARM = "FAN-IS" and ALARM="SRMISS" I don't want to show the two rows of the two alarms.

Example:

2017-07-11 13:00:25 FAN-IS MILAN
2017-07-11 13:01:42 SRMISS MILAN
2017-07-11 14:10:12 CARD-PROBLEM ROME

I want to show only:

2017-07-11 14:10:12 CARD-PROBLEM ROME

Any ideas?

Thanks!

[somesoni2]

Try this

Your query giving fields _time ALARM NODE
| eventstats values(ALARM) as alarms by NODE
| where NOT (isnotnull(mvfind(alarms,"FAN-IS")) AND isnotnull(mvfind(alarms,"SRMISS"))) 

Updated answer

 Your query giving fields _time ALARM NODE
  | eventstats values(ALARM) as alarms by NODE
  | eval shouldKeep=if(isnotnull(mvfind(alarms,"FAN-IS")) AND isnotnull(mvfind(alarms,"SRMISS")),"No","Yes")
  | where shouldKeep="Yes"

[ngerosa]

Hi somesoni2,
I tried but it didn't work.
The following is the results of the search:

ALARM NODE _time alarms
SRMISS MILAN 2017-06-21 13:08:18.0 FAN-IS
SRMISS

[somesoni2]

Try this

Your query giving fields _time ALARM NODE
 | eventstats values(ALARM) as alarms by NODE
 | where isnull(mvfind(alarms,"FAN-IS")) AND isnull(mvfind(alarms,"SRMISS"))
| fields - alarms

[ngerosa]

It doesn't work.
The search include all alarms (FAN-IS and SRMISS)

[somesoni2]

How about this?

Your query giving fields _time ALARM NODE
 | eventstats values(ALARM) as alarms by NODE
 | eval shouldKeep=if(isnotnull(mvfind(alarms,"FAN-IS")) AND isnotnull(mvfind(alarms,"SRMISS")),"No","Yes")
 | where shouldKeep="Yes"

If this doesnt work then remove last where clause and see if the values are coming per your requirement (manual check).

[ngerosa]

It works!!
Thank you very much!
If you modify the answer I'll accept!