How can I abort a search when a subsearch returns zero results

[pde]

I'm doing something like this:

[search host=*prod* source=*stats.log execTime > 10000 | fields msgID] | search host=*prod*

Which returns all my statistical and transactional records for msgIDs whose statistical record shows they took more than 10 seconds to complete. The problem is that when there are no results returned from the subsearch, the format passed to the parent search is "NOT()", which causes all records from the time period to be displayed. This is highly confusing to the user.

How can I abort the parent search and show no results when the subsearch returns nothing?

Thanks

[Stephen_Sorkin]

It should not be the case that "NOT ()" matches everything. By convention, "()" is the same as "*" to Splunk (this is because the empty set of conjuncts should match everything). So "NOT ()" is the same as "NOT *" which should match nothing.

I verified this by the search:

[stats count | search count = 1] | stats count

This yields an empty subsearch which results in "NOT ()" and no results come out.