Find unique events in one search and NOT the other

[Joe20]

I have events with two keys area and errortext. Sample event below: 

[2021-02-20 19:27:37.599 GMT] ERROR Servlet|test-event| element=PlaceOrder,routine=start,receiptNumber=000006,errortext="Initiating ReversePayments for Order, Reason: Inventory reservation failed"

I need to find :

1. unique events that match element and errortext values for a time window -1

2. find the same unique events for a time window-2  then 

3. find events that are present in time window-1 and NOT in time window-2 

To find unique events in time-window-1  --I am using the below query. 

index=dev sourcetype!=warn element AND errortext earliest=@w5 latest=+7d@w6 | dedup element,errortext | table element,errortext

 I am trying to use search and NOT but not able do so in this case. 

SearchOne NOT [ SearchTwo ]

[Joe20]

This worked. Thank you very much @tscroggins

[tscroggins · Accepted solution]

@Joe20 

Using an example time window of 24 hours, try:

element=* errortext=* earliest=-24h latest=now NOT [ element=* errortext=* earliest=-48h latest=-24h | table element errortext ]

This will return events over the last 24 hours with key field combinations (element AND errortext) that were not present between 48 and 24 hours ago.

You may want to review timestamp extractions and time zone offsets if you frequently need to search for future times, e.g. +7d@w6, and those future times are not be design.