Find the "No events"

[fred1455]

Given the search

stats count by Name, Fruit

results in:

Name, Fruit, count
Mike, Bananas, 10
Mike, Apples, 10
Susan, Apples, 5
Fred, Apples, 8
Susan, Oranges, 9
Fred, Oranges, 9

How to find only the persons without Oranges?
Result should be:

Mike
****

As the names are dynamic I do not have an inputlookup file for them ...
Thanks
Robert

[woodcock]

Like this:

index=YouShouldAlwaysSpeciryAnIndex AND sourcetype=AndSroucetypeToo
| stats count BY Name, Fruit

| rename COMMENT AS "I believe that above is your existing search, so just add what is below"

| evenstats values(Fruit) AS Fruits BY Name
| search NOT Fruits = "Oranges"

[martin_mueller]

Assuming you're looking for names that have fruit but no Oranges, stats values(Fruit) as Fruits by Name | search NOT Fruits = "Oranges".

If you're also looking for names that have no fruit at all then you'll need a list of reference names, otherwise any name ever would need to magically appear out of nowhere.

[martin_mueller]

Then you didn't run the search I wrote.

[fred1455]

Thanks for you effort.

But this will return:

Also Susan and Fred (as the also have lines without Oranges!)

What I want to see in my result is:

Only Mike

(as he is the only person without oranges)

But thanks

Robert