You should try to avoid join - and in almost all cases, you can with stats. If you want only failures which have also succeeded, then replace my previous last 2 lines with | stats values(isFailed) as isFailed by orderNumber
| where mvcount(isFailed)=2 So, this will trigger when you have both a 0 and 1 join has limitations, it's slower and can cause unpredictable results depending on your data volume. Note also that neither of these will deal with any time ordering of the events. You're looking for 'previous' success, but this will not show you whether the success comes before the failure.
... View more