Is it possible to use saved searches to exclude results in another search?

[crades]

Is it possible to use saved searches to exclude results in another search?

Something like :

Error NOT IN savedsearch("knownIssue1", "knownIssue2")

Thanks

[somesoni2]

Its is possible (not in the format you mentioned) using subsearch as filter. May be something like this (assumming both the saved searches have field called Error which you need to filter from base search)

your base search e.g. index=xxx sourcetype=yyy NOT [|savedsearch knownIssue1 | table Error | append [|savedsearch knownIssue2 | table Error]] |...rest of the search

Samples of subsearch being used as filter
http://answers.splunk.com/answers/89845/filter-search-results-based-on-return-value-of-subsearch

[crades]

Cool. That should work for me.

Thanks for the answer and link.

[somesoni2]

Good catch. Totally missed that one.

[martin_mueller]

Don't forget the NOT before the first opening square bracket to exclude the key-value-pairs from the subsearch rather than to require them.