Thank you thambisetty. Here is the slightly modified version that worked for my use case:   index=myindex sourcetype=mysourcetype | table event,ref,foo | eval type=case(event=="string1","search1",event=="string2" AND foo=="bar","search2") | eventstats dc(type) as dc_type by ref | search dc_type=1 AND type=search1   This returns only events that match the following criteria: 1. They have 'string1' as their event 2. They do not have a corresponding 'event=string2 AND foo=bar' event, with 'corresponding' in this case being determined by the ref field via  'as dc_type by ref'. ... View more