How to filter a search result based on the results of another search?

[AllenZhang]

I have 2 searches:

search AAA|table User
Search BBB|tabble User

How can I filter the result of Search AAA so it only shows those Users which are NOT found in search BBB?

Thanks

Allen

[MuS]

Hi AllenZhang,

although I'm no fan of sub searches, you can do it with a subsearch:

search AAA | search NOT [ search BBB | table User ]

Here are some reasons why it is not always a good idea to use subsearch http://docs.splunk.com/Documentation/Splunk/6.3.1/Search/Aboutsubsearches#Subsearch_performance

Hope this helps ...

cheers, MuS

Update:
Here is run everywhere example which is doing the same without a subsearch:

 index=_internal OR index=_audit 
 | stats dc(user) AS dc by user,index 
 | stats sum(dc) AS sum values(index) AS index by user 
 | table index user sum 
 | where sum="1"

It search in two indexes for users which are only found in one of the indexes.

cheers, MuS