https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-search-result-based-on-the-results-of-another/m-p/237005#M70452 <P>Hi AllenZhang,</P> <P>although I'm no fan of sub searches, you can do it with a subsearch:</P> <PRE><CODE>search AAA | search NOT [ search BBB | table User ] </CODE></PRE> <P>Here are some reasons why it is not always a good idea to use subsearch <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1/Search/Aboutsubsearches#Subsearch_performance">http://docs.splunk.com/Documentation/Splunk/6.3.1/Search/Aboutsubsearches#Subsearch_performance</A></P> <P>Hope this helps ...</P> <P>cheers, MuS</P> <P><STRONG>Update:</STRONG><BR /> Here is run everywhere example which is doing the same without a subsearch:</P> <PRE><CODE> index=_internal OR index=_audit | stats dc(user) AS dc by user,index | stats sum(dc) AS sum values(index) AS index by user | table index user sum | where sum="1" </CODE></PRE> <P>It search in two indexes for users which are only found in one of the indexes.</P> <P>cheers, MuS</P> Tue, 19 Jan 2016 20:17:34 GMT MuS 2016-01-19T20:17:34Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-search-result-based-on-the-results-of-another/m-p/237004#M70451 <P>I have 2 searches:</P> <PRE><CODE>search AAA|table User Search BBB|tabble User </CODE></PRE> <P>How can I filter the result of Search AAA so it only shows those Users which are NOT found in search BBB?</P> <P>Thanks</P> <P>Allen</P> Tue, 19 Jan 2016 20:09:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-search-result-based-on-the-results-of-another/m-p/237004#M70451 AllenZhang 2016-01-19T20:09:21Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-search-result-based-on-the-results-of-another/m-p/237005#M70452 <P>Hi AllenZhang,</P> <P>although I'm no fan of sub searches, you can do it with a subsearch:</P> <PRE><CODE>search AAA | search NOT [ search BBB | table User ] </CODE></PRE> <P>Here are some reasons why it is not always a good idea to use subsearch <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1/Search/Aboutsubsearches#Subsearch_performance">http://docs.splunk.com/Documentation/Splunk/6.3.1/Search/Aboutsubsearches#Subsearch_performance</A></P> <P>Hope this helps ...</P> <P>cheers, MuS</P> <P><STRONG>Update:</STRONG><BR /> Here is run everywhere example which is doing the same without a subsearch:</P> <PRE><CODE> index=_internal OR index=_audit | stats dc(user) AS dc by user,index | stats sum(dc) AS sum values(index) AS index by user | table index user sum | where sum="1" </CODE></PRE> <P>It search in two indexes for users which are only found in one of the indexes.</P> <P>cheers, MuS</P> Tue, 19 Jan 2016 20:17:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-search-result-based-on-the-results-of-another/m-p/237005#M70452 MuS 2016-01-19T20:17:34Z