I have 2 searches:
search AAA|table User
Search BBB|tabble User
How can I filter the result of Search AAA so it only shows those Users which are NOT found in search BBB?
although I'm no fan of sub searches, you can do it with a subsearch:
search AAA | search NOT [ search BBB | table User ]
Here are some reasons why it is not always a good idea to use subsearch http://docs.splunk.com/Documentation/Splunk/6.3.1/Search/Aboutsubsearches#Subsearch_performance
Hope this helps ...
Here is run everywhere example which is doing the same without a subsearch:
index=_internal OR index=_audit
| stats dc(user) AS dc by user,index
| stats sum(dc) AS sum values(index) AS index by user
| table index user sum
| where sum="1"
It search in two indexes for users which are only found in one of the indexes.