Need help in adjust log dashboard records

[Mohangurrampati]

Hi Team,

I am trying to adjust logs records in dashboard. we have exist logs records which have deviceid and storenumber and servicename and others. I am setting up new logs have only storenumber and deviceid unique one record with no duplicates of same deviceid and status column as well. while doing i got required unique deviceid record in logs but i need to deviceid records where deviceid record is empty also. Please help me to modify below query and help me to get empty deviceid records as well.

Query :

fetch logs
| filter matchesValue(service.name, "SBNA")
| filter matchesValue(status, "ERROR")
| fields storenumber, deviceid, status, service.name
| summarize storenumber = first(storenumber), deviceid = first(deviceid), status = first(status), service_name = first(service.name)
| sort status desc

[marco_irmer]

Try this:

fetch logs
| filter matchesValue(service.name, "SBNA")
| filter matchesValue(status, "ERROR")
| summarize status = first(status), by: { storenumber, deviceid, service.name }
| fields storenumber, deviceid, status, service.name
| sort status desc