Splunk query to filter the results

[iamsplunker]

Hi Splunk Community, 

I have a query which has 5eventtypes 

index=apple source=Data AccountNo=*

eventType=DallasOR 

eventType=Houston OR

eventType=New York OR 

eventType=Boston OR 

eventType=San Jose| table AccountNo eventType _time

It has to pass eventType=1 to reach it to next stage i.e, eventType=2 so on. Then only we can assume as it's a successful account

Now I wanted to have the query for the unsuccessful accounts meaning..the account does not pass  eventtype=1 but it reached to next stages like eventType=2 or eventType=3 so on.

--

Currently I'm using this query but it's not working 

index=apple source=Data AccountNo=*  eventType!=1

Please help

[ITWhisperer]

Do you mean you want to know which accounts don't have all 5 eventTypes?

index=apple source=Data AccountNo=* 
| stats values(eventType) as eventTypes by AccountNo
| where mvcount(eventTypes) != 5

[iamsplunker]

@ITWhisperer : Thanks for your response . I'm looking for which account doesn't passed or doesn't have eventType=Dallas(which is first stage) but went for the next stage like eventType=Houston or eventType=New York etc..

[ITWhisperer · Accepted solution]

| stats values(type) as types by account
| where NOT match(types,"Dallas")

[iamsplunker]

@ITWhisperer : Your query is working, I have a quick question.. what if I also want to exclude type="Houston"

I've tried 

| stats values(type) as types by account
| where NOT match(types,"Dallas") OR NOT match(types,"Houston")

but it's not working as expected. Can you please advise- Thanks

[ITWhisperer]

When using negative conditions you need to use AND rather than OR

| where NOT match(types,"Dallas") AND NOT match(types,"Houston")

 Consider a cat - if the condition was not a cat or not a dog it would be true because a cat is not a dog, whereas if the condition was not a cat and not a dog it would be false because while a cat is not a dog, it is a cat.