About queriousGeorge

queriousGeorge · ‎02-14-2023

This ended up working for me: `index=main "failed insert" | stats count by orderNumber | eval previousSuccess=0 | table orderNumber previousSuccess | join type=left orderNumber [search index=main “successful insert” | eval previousSuccess=1 | table orderNumber previousSuccess] | table orderNumber previousSuccess | where previousSuccess=0` I needed a count of not only the fails, but the fails with a previous success.

queriousGeorge · ‎02-13-2023

I have two searches that will return orderNumbers 1. index=main "Failed insert" | table orderNumber //returns small list 2. index=main "Successful insert" | table orderNumber //returns huge list I want a list of "Failed insert" orderNumbers that have NOT had a "Successful insert" previously. How can I use the results of the second search to filter the results of the first search?

Posts	3
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎02-13-2023

Online Status	Offline
Date Last Visited	‎03-08-2023 02:56 PM

How to filter small table results by large table r...

Re: Filter small table results by large table resu...

How to filter small table results by large table r...