Hi, I am facing difficulties in forming one search. Details are following. Two different searches, Search1: source="/opt/pmx6/var/log/message_log" | stats count by t Search2: source="/var/log/maillog" "Host or domain name not found" OR "Host not found"| | stats count by to Here t and to are same fields with same values. I need a consolidated search in Search1 which gives me results of count t, but exclude the events found in Search2. So far I've tried, 1) source="/opt/pmx6/var/log/message_log" | join t [search source="/var/log/maillog" "Host or domain name not found" OR "Host not found" | rename to as t] | stats count t This search gives me all the events which found respectively in Search2. (Opposite of what I want!) 2) Tried to add Splunk Suppression, index=notable| join t [search source="/var/log/maillog" "Host or domain name not found" OR "Host not found"| rename to as t] But seems like pipes are not allowed there. It would be a gr8 help. Thanks in advance guys. 🙂 ... View more