OK I have been reading most of the morning and I have to just be missing something very simple. To explain what I am trying to do. 1. Lets take the simple query index=* host=*test*|dedup host|table host This will obviously give me a unique list of hosts. 2. Second Query index=* host=*test* "Bleebles"|dedup host|table host This query will give me a unique list of hosts where the string "Bleebles" was found. (Obviously this is just example data) What I am trying (And failing) at is marrying these two queries up, and returning ONLY hostnames that DO NOT return records with the string "Bleebles" but of course issue #1 is when I invert the logic on search #2 I get EVERY record that has been splunked and doesn't match (Which is literally all the data)  Can anyone help with the logic I am missing here, using the two very basic queries above how would I first generate the full host list (That's the easy part) but then print a deduped list of hostnames that did NOT return a result in query #2, thereby giving me an exceptions list?     ... View more