Using fireall logs to find hosts that do not use a specific protocol

[john_byun]

I have the following query for PAN firewall logs:

index=pan app=ssl

| stats count by src

This would give me a list of all src IPs of devices that use SSL.  How would I create a query to give me the opposite results?  I want the list of src IPs that never have SSL traffic.

[DalJeanis]

Here's one way:

index=pan app=*
| stats count by src app
| where app!="ssl"

Here's another:

index=pan app!="ssl"
| stats count by src

[john_byun]

I am looking to list all src's that do not use ssl.  Your query basically gives me the same results because all src's use multiple apps.

Is there a way to do this without me doing a massive diff of tens of thousands of results?

[DalJeanis]

Try this

index=pan app=*
| stats count values(app) as app by src
| where NOT (app="ssl")