Filter the results of the main search based on the field values from the subsearch.

[pkakodkar]

I have 2 independent queries run on 2 different index that give me a list of requestIds. I want to filter/not include the requestIds of the second query in my search. I am trying to use the following query to do so but its not filtering the results from second query. What am i doing wrong here 

index="index1" <query1> | rename requestId AS Result | table Result | search NOT [search index="index2" <query2>| rename RequestId AS Result| table Result]

[ITWhisperer]

Try the second query as part of the first search, something like this

first query NOT [second query | table requestId]

[pkakodkar]

@ITWhisperer  

I updated the query i am using in the thread above.

The query you sent doesnt work . It doesnot filter out the results.

One thing to note is in the first query the fieldName is "requestId" and secondquery has fieldName is "RequestId"  Hence i am renaming the field to see if it works

[ITWhisperer]

Here is a runanywhere search showing this technique working

| makeresults count=10 
| streamstats count as row 
| eval result=mvindex(split("ABC",""),row%3)
| search NOT
    [| makeresults
    | eval result=split("AB","")
    | mvexpand result]

Perhaps there is something else going on in your search or your data which might explain it. Can you share more?