it took me some time to figure this out but i believe this is what you are looking for. (math logic)
Not the most performant search query but works.
replace my_index with your index and try this:
index=my_index "Handle State structures to abandoned" | stats count by source | eval status = "keep" | append [search index=my_index "KERNEL RECYCLING" | stats count by source | eval status = "remove" ] | stats values(status) AS status by source | search status!=remove
Small explanation on this:
1- list the sources that have "Handle State structures to abandoned" and build a field called status with "keep" as value
index=my_index "Handle State structures to abandoned" | stats count by source | eval status = "keep"
2 - list the sources that have "KERNEL RECYCLING", build a field called status with "remove" as value and append the result to 1:
...| append [search index=my_index "KERNEL RECYCLING" | stats count by source | eval status = "remove" ]
3 - list both results by status (sources that you want keep or remove) and filter the ones you do not want to show:
...| stats values(status) AS status by source | search status!=remove
------------
Hope I was able to help you. If so, some karma would be appreciated.
