How to filter out main search results with subsearch?

[upranger101]

Hi I am trying to capture all event="DcSyncs" from my index. This index also contains event="DcID". The event "DCSyncs" can occur at anytime (pretty often though), but "DcID" occurs once every 8 hours. I am trying to get all "DcSyncs" and then take the HostName field of those results and see if that HostName field has a result for event="DcID". If it does filter it out of the results. To summarize: I am trying to collect all HostName's that have a "DCSyncs" event, but no "DcID" event. I have this setup to run on an 8 hour interval so I don't think I need the time logic of the search.

 I keep trying different variations, but I think I am way off. Any help is appreciated.

index=MyIndex event="DcSyncs"
| join HostName [search NOT index=MyIndex event="DcID"]
| table _time HostName event

[upranger101]

Thank you richgalloway. I new host had to be referenced in the subsearch somehow and I didn't know that function exist.

[richgalloway · Accepted solution]

Your query is close, but there's no need for a join, just use the subsearch.

index=MyIndex event="DcSyncs" NOT [search index=MyIndex event="DcID" | fields host]
| table _time HostName event