Assuming your script results yield one event per excluded user with a user field set to its login, you can do this: sourcetype=something NOT [HRUserException] That will take the results of the subsearch, for example these events: 1: user=foo 2: user=bar 3: user=baz and turn that into this search string: ( ( user="foo" ) OR ( user="bar" ) OR ( user="baz" ) ) The NOT in front of the subsearch will exclude those three users from the search, giving you this main search: sourcetype=something NOT ( ( user="foo" ) OR ( user="bar" ) OR ( user="baz" ) ) If your external command results don't have a user field yet you may need to rex it out of the results first. ... View more