In the below search I am looking for rules hit by count, but how or where would I add a NOT or !, if I wanted to know what rules have not be hit. index=pan_logs | fields _time, rule | stats count by rule | sort -count ... View more