I have 2 independent queries run on 2 different index that give me a list of requestIds. I want to filter/not include the requestIds of the second query in my search. I am trying to use the following query to do so but its not filtering the results from second query. What am i doing wrong here
index="index1" <query1> | rename requestId AS Result | table Result | search NOT [search index="index2" <query2>| rename RequestId AS Result| table Result]
Try the second query as part of the first search, something like this
first query NOT [second query | table requestId]
I updated the query i am using in the thread above.
The query you sent doesnt work . It doesnot filter out the results.
One thing to note is in the first query the fieldName is "requestId" and secondquery has fieldName is "RequestId" Hence i am renaming the field to see if it works
Here is a runanywhere search showing this technique working
| makeresults count=10
| streamstats count as row
| eval result=mvindex(split("ABC",""),row%3)
| search NOT
[| makeresults
| eval result=split("AB","")
| mvexpand result]
Perhaps there is something else going on in your search or your data which might explain it. Can you share more?