When i run the searches separately, the first one returns 1841 events and the second one returns 487 events.
But the combined search does not exclude the results from the second search so I get the full 1841 events again.
When I use those searches with stats, just to get the count of the events, everything looks fine and I get the deisred result of 1354 with the following search:
index=my_index asset_type="Workstation" asset_atp="false" asset_status="ACTIVE" earliest=-1d@d latest=-0d@d
| stats count as TotalA
[search index=my_index asset_type="Workstation" asset_status="ACTIVE" earliest=-1d@d latest=-0d@d
| eval nexttime=strftime(relative_time(now(),"-w@w") ,"%Y-%m-%d %H:%M:%S")
| where ad_date_created>nexttime
| stats count as TotalB]
| eval Total=TotalA-TotalB
| fields Total
Can you pleae try the below query and let me know whether it is working as expected.
index=my_index asset_atp="false" earliest=-1d@d latest=-0d@d | eval ExceptionType=if(searchmatch ("Workstation"), ("ACTIVE"),("false")
| eventstats dc(ExceptionType) AS numExceptionTypes values(ExceptionType) AS ExceptionTypes | search numExceptionTypes=1 AND ExceptionType="false"
I have tried my level best based on your inputs. Lets c 🙂