Try something like this index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" | where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats count by traceID | eval search="\"".traceID."\"" | stats values(search) as search | eval search = mvjoin(search,",")]) ... View more

As I mentioned in your new thread, you just exclude Failed from the restrictive filter, i.e., index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request" | eval LabelType=coalesce(labelType, documentType) | eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async") | where status != "Failed" AND (event == "Sync" AND source like "%gps-request-processor%" OR event == "Async" AND (source like "%gps-external-processor%" OR source like "%gps-artifact-processor%")) | stats count(eval(status=="Failed")) as failed by sourceNodeCode geoCode LabelType event ... View more

So this is to add one more condition to the selection command I described in Re: Count based on condition. (If that original problem is solved, please mark an answer as solution.) All you need to do is to exclude Failed from the restrictive condition, i.e., index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request" | eval LabelType=coalesce(labelType, documentType) | eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async") | where status!="Failed" OR (event == "Sync" AND source like "%gps-request-processor%" OR event == "Async") AND (source like "%gps-external-processor%" OR source like "%gps-artifact-processor%") | stats count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event ... View more

With dbinspect you can get details of single buckets. So dbinspect should give enough details to warn against both rolling oldest bucket as well as hitting size limit. ... View more

Thank you @ITWhisperer  it's working ... View more

The AND operator in the where command must be in upper case. If you still don't get results, use the table command to examine the ts, info_min_time, and info_max_time fields. ... View more

Hi @csahoo, for my expertience there isn't any requirement from regulations or logic to have a forever retention on your logs! You should understand if there are regulations requirements that usually are the drivers in retention policies: e.g. in Italy there's a regulation that requires 6 months or retention for system access logs. About the logs not under a regulation, you could maintain that for three, six or twelve months, more I think that it's completely unuseful. Eventually, you could maintain some statistics for two or three years, but not full logs. The reason of this is obviously that logs maintaining requires storage and it cost, especially if you have a great daily volume. I hope to be useful in my dissertation on maximum systems, at the end, try to have the less quantity of logs as possible  to maintain. Ciao. Giuseppe ... View more

Thank you very much  @ITWhisperer @somesoni2 both the queries are working fine ... View more