I am attempting to build a search that pulls back all logs that have a value in a multi-value field but do not have other values. With a few values I do not care if exist or not. To break it down more. The field "names" must have "bob". The field "names" can have any or all "tom","dan","harry" but is not required to have them. The field "names" cannot have any other value. I do not have a full list of the names and they can change over time so it is not possible to make a list of the "names" I do not want. I need other values from the logs just filtering by the "names" field as an example. As a few examples: "bob"= returned in the search "bob","tom" = returned in the search "tom","dan" = not returned in the search "bob","sam" = not returned in the search "bob","harry","fred" = not returned in search I am having trouble figuring out what to use to exclude multi-value fields in this way.
... View more