Status Field Showing Both the values in same field?

[karthi2809]

Hi All,

This the query which i try to get status.But in the table its shows both error and success.PFA screenshot

| eval Status=case(priority="ERROR" AND tracePoint="EXCEPTION" OR message="*Error while processing*","ERROR", priority="WARN","WARN",priority!="ERROR" AND tracePoint!="EXCEPTION" OR message!="*(ERROR):*","SUCCESS") |stats values(Status) as Status by transactionId

[ITWhisperer]

This is because the transaction ids have events with both sorts of status. If you just want the latest, you could try something like this

|stats latest(Status) as Status by transactionId

[karthi2809]

If i use some of the transactionID is error but some of its showing as Success.If the priority=error and exception="error" but the status is SUCCESS.I dont know y.

[ITWhisperer]

Please provide some anonymised representative events which demonstrate the issue you are facing, what results you are getting, and your expected results.

[karthi2809]

Based on priority field and tracepoint field i am getting the status field.If priority is error and tracepoint as exception then i set status as per the keyword.But in some case its showing both ERROR and SUCCESS.

Message	priority	tracepoint
After Common SFTP Get File List Response	INFO	AFTER_REQUEST
After Common SFTP Get File List Response	INFO	AFTER_REQUEST
Before Common SFTP Get File Data Request	INFO	BEFORE_REQUEST
Before Common SFTP Get File List Request	INFO	BEFORE_REQUEST
Before Common SFTP Archive File Request	INFO	BEFORE_REQUEST
File Upload Request for BEFORE_REQUEST	INFO	BEFORE_REQUEST
File Upload to in SFTP mode. >>> END	INFO	END
		END
File Upload Request for f	ERROR	EXCEPTION
Error while trying to upload file to GCP from Common SFTP	ERROR	EXCEPTION
DEV(ERROR): Error while processing System request	INFO	BEFORE_REQUEST

[ITWhisperer]

So if a transaction has both ERROR and not ERROR, what do you want it to show?

[karthi2809]

If error and exception then it should be error rest of them are success.but using the below query to get status still.i got both suuccess and error for the some of the transactions ID 

| eval Status=case(priority="ERROR" AND tracePoint="EXCEPTION" OR message="*Error while processing*","ERROR", priority="WARN","WARN",priority!="ERROR" AND tracePoint!="EXCEPTION" OR message!="*(ERROR):*","SUCCESS") |stats values(Status) as Status by transactionId

[ITWhisperer · Accepted solution]

| eval Status=case(priority="ERROR" AND tracePoint="EXCEPTION" OR message="*Error while processing*","ERROR", priority="WARN","WARN",priority!="ERROR" AND tracePoint!="EXCEPTION" OR message!="*(ERROR):*","SUCCESS") |stats values(Status) as Status by transactionId
| eval Status=mvindex(Status, 0)