How can I exclude a subset of tags from my metadata search?

[Simeon]

I run a metadata search that populates a summary page to link to all of my tags. The goal of the summary page is to individually list anything tagged with a certain name. I have many sources with multiple tags. For example, I have tagged a source as "access_log" and "web_server". I want to create a search that will filter out any tags that do not have "log" in the name. This way I can have populate my summary page with two listings, one that has all *log tags and one that does not. I have been trying the following search:

| metadata type=sources index=* | tags | search tag::source!=NULL | search tag::source!=*log* 

The above search works great as long as each source has only been tagged once, with "log" in the name or not. I want a listing that excludes the sources that have been singularly tagged with "log" in the name. I still want the sources that have been tagged with other names, but just want to filter out the singularly tagged stuff. How can I construct a search that will return all sources that have only been tagged with "log" in the name?

[Simeon · Accepted solution]

The mvexpand command will expand out the tags listing to become separate events. From there, you would then need to dedup the events so you don't have multiple listings of the same tag. The modification needed is as follows:

| metadata type=sources index=* | tags | search tag::source!=NULL | mvexpand tag::source | search tag::source!=*log* | dedup tag::source