I'm trying to create an SPL which will give me the results as per below:
Search for all users for have visited "store.com" but for those user who visited nzcompany.com then don't display that user in a table. (although they did visit store.com)
User | URL |
Brad | store.com |
Tom | store.com |
Bart | nzcompany.com |
Lisa | store.com |
Bart | store.com |
Tom | store.com |
Lisa | store.com |
Lisa | nzcompany.com |
Lisa | store.com |
Results | |
Tom | |
Brad |
i tried to do this but didnt work
index=network (url=store.com AND url!=nzcompany.com)
| table user
Thanks
| chart count by User URL
| where 'store.com' > 0 AND 'nzcompany.com' == 0