How to find unique events in a dashboard with a base search and several post-process searches?

[polssn]

I have a dashboard which uses a base search that finds all events that we are interested in, then use post-process searches to classify this data into several different categories ("known concerns").

In the end, I want to display all events that are not picked up by any of these post-process searches, but I can't seem to find any primitive that would do this.

Basically, the logic I need is: BASE XOR (CATEGORY1 OR CATEGORY2 OR ...)

Ideally without having to duplicate the post-process searches again, since the results are already found.

[mayurr98]

So in short you need to filter out post process searches using NOT and OR operator.
Your query would be BASE NOT (CATEGORY1 OR CATEGORY2 OR ...)

Try this run anywhere XML

<dashboard>
  <label>Post Process Searches</label>
  <search id="Base_Search">
       <query>index=_internal | head 1000</query>
   </search>
  <row>

    <panel><title>ERROR</title>
      <event>
        <search base="Base_Search">
           <query>| search "ERROR"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
  <row>
    <panel><title>INFO</title>
      <event>
        <search base="Base_Search">
           <query>| search "INFO"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
  <row>
    <panel><title>WARNING</title>
      <event>
        <search base="Base_Search">
           <query>| search "WARNING"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
   <row>
    <panel><title>NOT "ERROR" NOT "WARNING" NOT "INFO"</title>
      <event>
        <search base="Base_Search">
           <query>| search NOT "ERROR" NOT "WARNING" NOT "INFO"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</dashboard>

let me know if this helps!