Trying to use subsearch to filter records

[joesrepsol]

Looking at event data to run some eval commands... specifically on records with any "Status" value. Then once I get those events eval's done and narrowed down, I want to only see the events with Status!=Closed.

So how can I look at ALL events at the front-end of the query, then filter down to a specific xxx=yyy at the back-half of the query?

Mind has melted... ha

thanks!

joe

[woodcock]

Records with any value for field Status:

index="foo" sourcetype="bar" Status="*"

Then add this to limit to certain ones:

| search Status!="Closed"