index="db_oracle-prod" source="AzureVOCprod" status=4 | eval MSGStatus=case(status=1,"CREATED", status=2,"RUNNING", status=3,"CANCELLED", status=4,"Failed", status=5,"PENDING", status=6,"ENDED UNEXPECTEDLY", status=7,"SUCCEEDED",status=8,"STOPPING", status=9,"COMPLETED") | join package_name [inputlookup Azure_VOC.csv] | eval STARTTime=strptime((strftime(now(),"%Y-%m-%d")),"%Y-%m-%d") - strptime(start_time,"%Y-%m-%d") | where STARTTime=0 | stats count by Azure_Pipeline_name, start_time, end_time, MSGStatus   receiving record every 15mins instead we should have only failure ones based on timeframe ... View more

status=4  | eval MSGStatus=case(status=1,"CREATED", status=2,"RUNNING", status=3,"CANCELLED", status=4,"Failed", status=5,"PENDING", status=6,"ENDED UNEXPECTEDLY", status=7,"SUCCEEDED",status=8,"STOPPING", status=9,"COMPLETED") |join package_name [inputlookup Azure_VOC.csv] | eval STARTTime=strptime((strftime(now(),"%Y-%m-%d")),"%Y-%m-%d") - strptime(start_time,"%Y-%m-%d")| table Azure_Pipeline_name, MSGStatus, end_time, start_time   query running every 15mins and counting same failure ... View more