How find hosts that are missing a particular sourcetype

[omgwut56k]

My windows hosts should have 'WinEventLog:Security' and Script:InstalledUpdates.

How can I search for hosts that have Script:InstalledUpdates but is missing 'WinEventLog:Security' ?

Thank you

[martin_mueller · Accepted solution]

Try this:

| tstats values(sourcetype) as sourcetypes where index=yourindex by host
| search sourcetypes="Script:InstalledUpdates" NOT sourcetypes="WinEventLog:Security"

[omgwut56k]

Thank you!