I'm trying to create an SPL which will give me the results as per below:
Search for all users for have visited "store.com" but for those user who visited nzcompany.com then don't display that user in a table. (although they did visit store.com)
| User | URL |
| Brad | store.com |
| Tom | store.com |
| Bart | nzcompany.com |
| Lisa | store.com |
| Bart | store.com |
| Tom | store.com |
| Lisa | store.com |
| Lisa | nzcompany.com |
| Lisa | store.com |
| Results | |
| Tom | |
| Brad |
i tried to do this but didnt work
index=network (url=store.com AND url!=nzcompany.com)
| table user
Thanks
| chart count by User URL
| where 'store.com' > 0 AND 'nzcompany.com' == 0