There is an async process that logs first when something is created, then again when it is picked up by a service that will send a notification. I would like to create a visual that easily identifies customers with dropped notifications. (The two events occur within a minute.) I have two searches that share a common ID and identify the events above. When things are working well the counts by customer per day will be the same from both searches.  Is it possible to correlate the two searches to show any differences in these counts? In this sanitized example MyIdA is the ID from search A while MyIdB is the same ID from search B (search A) OR (search B) | rex "cust (?<MyIdA>\d+)" | rex "\"custId\",\"value\":\"(?<MyIdB>\d+)" ... View more

There is a process I'm trying to track. It starts by generating a single event. Then asynchronously a second event is created. My problem is that the async process often fails. I would like to find all occurences of the first event that do not have a corresponding second event. I know how to search for each event independently. They share a couple common identifiers that can be extracted. I have tried a subsearch and a join but have not gotten any results. As a compressed and simplified example, here is my pseudo search index=idx1 ... (identifiers here) | rex "EventId: (?<event_id>\d+)" | join type=left event_id [ search index=idx1 ... (identifiers here) | rex "\"EventId\",\"value\":\"(?<event_id>\d+)" ] Both events occur at about the same time, usually within a second. They share the EventId extracted field which can be considered unique within the time period I'm searching. Limits are not an issue as this process occurs about 100 times a day. So how can I list out the EventIds from the main search that do not have a match in the second search? Thank you experts! ... View more