title: Log Analytics - Only list PC that have errors in event log if there is no subsequent success log
body: <p>I am new to log analytics and am trying to get a list of PCs that have failed a process without subsequently succeeding.</p>
  <p>In my example, a PC will log an error event 360 and can do this many times, until the issue is resolved, then it will log a 300 success.</p>
  <p>I have 2 simple queries that return all the success and error logs:</p>
  <p>Succeeds Log</p>
  <pre><code>Event
  | where EventLog == &quot;Microsoft-Windows-User Device Registration/Admin&quot; | where EventID == &quot;300&quot;
  | project Computer, TimeGenerated, EventLevelName, EventID, RenderedDescription
  </code></pre>
  <p>Error Log</p>
  <pre><code>Event
  | where EventLog == &quot;Microsoft-Windows-User Device Registration/Admin&quot; | where EventID == &quot;360&quot;
  | project Computer, TimeGenerated, EventLevelName, EventID, RenderedDescription
  </code></pre>
  <p>So I am looking to filter out all computers that have a 300 success log even if they have at some point failed (because they have been fixed).</p>
  <p>Thanks.</p>