source="/opt/pmx6/var/log/message_log" NOT [search source="/var/log/maillog" "Host or domain name not found" OR "Host not found"| stats count by to | rename to as t | fields t ] | stats count by t Another option, potentially avoiding limit issues re: the sub search returning too many results. Use a join with some extra logic: source="/opt/pmx6/var/log/message_log" | stats count as good by t | join type=outer t [ search source="/var/log/maillog" "Host or domain name not found" OR "Host not found"| stats count as bad by to | rename to as t ] | where isnotnull(good) and isnull(bad) The where statement will only keep those rows that have results from search1 AND NOT results from search2. ... View more