We have many completely diff events. Sometimes, we got a result based on Search 1. But we want to exclude some records from results of Search 2.
E.G., the below are events
event1: {name: mike, action: ok}
event2: {name: cool, action: ok}
event3: {name: mike, state: invalid}
My first search1 shall get event1, event2
ok | table name, action
My second search2 shall get event3
invalid | fields name
However, Search 1 shall exclude the result of Search 2, that is, only event 2 shall be gotten
I am trying to achieve by
ok | search NOT name IN ([invalid | fields name]) | table name, action
But obviously it is unsuccessful
Thanks for any advice
... View more