I am having trouble coming up with the correct query for a interesting situation:
Over a X hour period I may receive a output of process.status:failed or process.status:completed. Over this period let's say for process:1 I may of received a process.status that was initially failed but later re-attempted and it completed.
Is there a query I can run that will only show the process that contains process.status:failed but later did not contain a process.status:completed.
Basically just trying to weed out the process that ONLY failed during this complete timeframe?