I want to find entries added to a sourcetype today, that haven't been seen in the last N days. I've tried search A | fields + want | fields - ignore | search NOT [search B | fields + want | fields - ignore] and that doesn't seem to work. I still see results that are in search B.
... View more