Is it possible to use saved searches to exclude results in another search?
Something like :
Error NOT IN savedsearch("knownIssue1", "knownIssue2")
Thanks
Its is possible (not in the format you mentioned) using subsearch as filter. May be something like this (assumming both the saved searches have field called Error which you need to filter from base search)
your base search e.g. index=xxx sourcetype=yyy NOT [|savedsearch knownIssue1 | table Error | append [|savedsearch knownIssue2 | table Error]] |...rest of the search
Samples of subsearch being used as filter
http://answers.splunk.com/answers/89845/filter-search-results-based-on-return-value-of-subsearch
Cool. That should work for me.
Thanks for the answer and link.
Good catch. Totally missed that one.
Don't forget the NOT
before the first opening square bracket to exclude the key-value-pairs from the subsearch rather than to require them.