Thanks Soutamo for the reply. The below is my main search  "index="production_index" host="production" source="projects/production/logs/cloudaudit.googleapis.com%2Fdata_access" "protoPayload.authenticationInfo.principalEmail" = "*@.com" protoPayload.serviceData.jobGetQueryResultsResponse.job.jobStatistics.referencedTables{}.datasetId!="_*" protoPayload.serviceData.jobGetQueryResultsResponse.job.jobStatistics.createTime=*" I'm parsing GCP logs to find number of users per dataset. One SQL may contain reference to multiple datasets and when I exclude the control tables in my search the whole event is being excluded. ... View more