Discover Query Question

(Emil K.) #1


I am having trouble coming up with the correct query for a interesting situation:

Over a X hour period I may receive a output of process.status:failed or process.status:completed. Over this period let's say for process:1 I may of received a process.status that was initially failed but later re-attempted and it completed.

Is there a query I can run that will only show the process that contains process.status:failed but later did not contain a process.status:completed.

Basically just trying to weed out the process that ONLY failed during this complete timeframe?


(system) #2