Hi,
Whats the best way to return events from a search after also checking they're not contained within another index?
Currently trying this but dosent seem to produce accurate results;
| search NOT [ | search index=test_index sourcetype=test_sourcetype | fields rule_id ]
| table *
The idea being not to return any events where the rule_id has been seen in the test_index.
Thanks.
