assuming I have this log history: [sent] task=abc, id=123 [sent] task=abc, id=456 [success] task=abc, id=123 I would like to get a list of all ids that are "sent" but did not get a "success", so in the above example it should just be "456" my current query looks something like this   "abc" AND "sent" | table id | rename id as "sent_ids" | appendcols [ search "abc" AND "success" | table id | rename id as "success_ids" ]     this gets me a table with the 2 columns, and I'm stuck on how to "left exclusive join" the two columns to get the unique ids. or maybe I'm approaching this entirely wrong and there is a much easier solution? ... View more