https://community.splunk.com/t5/Splunk-Search/Trying-to-use-subsearch-to-filter-records/m-p/307630#M161049 <P>Records with <EM>any</EM> value for field <CODE>Status</CODE>:</P> <PRE><CODE>index="foo" sourcetype="bar" Status="*" </CODE></PRE> <P>Then add this to limit to certain ones:</P> <PRE><CODE>| search Status!="Closed" </CODE></PRE> Mon, 22 May 2017 22:44:12 GMT woodcock 2017-05-22T22:44:12Z https://community.splunk.com/t5/Splunk-Search/Trying-to-use-subsearch-to-filter-records/m-p/307629#M161048 <P>Looking at event data to run some eval commands... specifically on records with any "Status" value. Then once I get those events eval's done and narrowed down, I want to only see the events with Status!=Closed.</P> <P>So how can I look at ALL events at the front-end of the query, then filter down to a specific xxx=yyy at the back-half of the query?</P> <P>Mind has melted... ha</P> <P>thanks!</P> <P>joe</P> Mon, 22 May 2017 22:38:06 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-use-subsearch-to-filter-records/m-p/307629#M161048 joesrepsol 2017-05-22T22:38:06Z https://community.splunk.com/t5/Splunk-Search/Trying-to-use-subsearch-to-filter-records/m-p/307630#M161049 <P>Records with <EM>any</EM> value for field <CODE>Status</CODE>:</P> <PRE><CODE>index="foo" sourcetype="bar" Status="*" </CODE></PRE> <P>Then add this to limit to certain ones:</P> <PRE><CODE>| search Status!="Closed" </CODE></PRE> Mon, 22 May 2017 22:44:12 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-use-subsearch-to-filter-records/m-p/307630#M161049 woodcock 2017-05-22T22:44:12Z