https://community.splunk.com/t5/Splunk-Search/How-to-exclude-search-query-results-from-base-search/m-p/329852#M159900 <P>I have file processing events with 2 stages - X &amp; Y. I want to get filenames which have gone through X but not Y. I am unable to do so. Could you please advise?<BR /> I can list filenames with X stage or Y stage as below</P> <P>index=test stage=X | stats values(filename)<BR /> index=test stage=Y | stats values(filename)</P> Tue, 25 Jul 2017 15:16:22 GMT barunbiswas 2017-07-25T15:16:22Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-search-query-results-from-base-search/m-p/329852#M159900 <P>I have file processing events with 2 stages - X &amp; Y. I want to get filenames which have gone through X but not Y. I am unable to do so. Could you please advise?<BR /> I can list filenames with X stage or Y stage as below</P> <P>index=test stage=X | stats values(filename)<BR /> index=test stage=Y | stats values(filename)</P> Tue, 25 Jul 2017 15:16:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-search-query-results-from-base-search/m-p/329852#M159900 barunbiswas 2017-07-25T15:16:22Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-search-query-results-from-base-search/m-p/329853#M159901 <P>Try like this</P> <PRE><CODE>index=test stage=X OR stage=Y | stats values(stage) as stages by filename | where mvcount(stages)=1 AND stages="X" </CODE></PRE> <P>Basically select rows for both stages, generating list of stages each filename has gone through and finally, selecting only events which went though single stage which is "X".</P> Tue, 25 Jul 2017 17:17:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-search-query-results-from-base-search/m-p/329853#M159901 somesoni2 2017-07-25T17:17:30Z