Given the search
stats count by Name, Fruit
results in:
Name, Fruit, count
Mike, Bananas, 10
Mike, Apples, 10
Susan, Apples, 5
Fred, Apples, 8
Susan, Oranges, 9
Fred, Oranges, 9
How to find only the persons without Oranges?
Result should be:
Mike
****
As the names are dynamic I do not have an inputlookup file for them ...
Thanks
Robert
Like this:
index=YouShouldAlwaysSpeciryAnIndex AND sourcetype=AndSroucetypeToo
| stats count BY Name, Fruit
| rename COMMENT AS "I believe that above is your existing search, so just add what is below"
| evenstats values(Fruit) AS Fruits BY Name
| search NOT Fruits = "Oranges"
Assuming you're looking for names that have fruit but no Oranges, stats values(Fruit) as Fruits by Name | search NOT Fruits = "Oranges"
.
If you're also looking for names that have no fruit at all then you'll need a list of reference names, otherwise any name ever would need to magically appear out of nowhere.
Then you didn't run the search I wrote.
Thanks for you effort.
But this will return:
Also Susan and Fred (as the also have lines without Oranges!)
What I want to see in my result is:
Only Mike
(as he is the only person without oranges)
But thanks
Robert