Exclude records from the final result

[Anand_Raman]

Hi, I have a situation where I have to exclude certain records from the final result only. I don't want to include in the initial search criteria because it excludes the whole event. For example  a single event may contain many tables and if I exclude a certain table  in my initial search I'm getting a wrong count of other tables . I just want those table removed from my final results.

Thanks

[isoutamo]

Hi

usually this can do wit search and/or where commands. If you give some example data and full SPL query, we could help you with it.

r. Ismo

[Anand_Raman]

Thanks Soutamo for the reply. The below is my main search 

"index="production_index" host="production" source="projects/production/logs/cloudaudit.googleapis.com%2Fdata_access" "protoPayload.authenticationInfo.principalEmail" = "*@.com"
protoPayload.serviceData.jobGetQueryResultsResponse.job.jobStatistics.referencedTables{}.datasetId!="_*"
protoPayload.serviceData.jobGetQueryResultsResponse.job.jobStatistics.createTime=*"

I'm parsing GCP logs to find number of users per dataset. One SQL may contain reference to multiple datasets and when I exclude the control tables in my search the whole event is being excluded.

Anand_Raman_0-1611950724715.png