We have many completely diff events. Sometimes, we got a result based on Search 1. But we want to exclude some records from results of Search 2. E.G., the below are events   event1: {name: mike, action: ok} event2: {name: cool, action: ok} event3: {name: mike, state: invalid}     My first search1 shall get event1, event2   ok | table name, action   My second search2 shall get event3   invalid | fields name   However, Search 1 shall exclude the result of Search 2, that is, only event 2 shall be gotten I am trying to achieve by   ok | search NOT name IN ([invalid | fields name]) | table name, action   But obviously it is unsuccessful Thanks for any advice ... View more