Hello there! I need help with a search that is not providing the expected results. Let me share the details and background information: This search provides the list of the Windows server's IPs found by a network discovery scan:   index=tenable sourcetype="tenable:sc:vuln" repository=DISCOVERY pluginID=11936 | rex "(?i)Remote operating system : (?P<os>[\D\d]+(?=Confidence level))" | rex "(?i)Confidence level : (?P<os_confidencial_level>[\d]+)" | makemv delim="\n" os | search os=*windows*server* | table ip dnsName os os_confidencial_level | dedup ip dnsName os   It delivers a total of 28806 IPs. This another search provides the list of the Windows server's IPs located in the CMDB:   index=snow_ci sourcetype=cmdb_ci_server SYS_CLASS_NAME="Windows Server" OPERATIONAL_STATUS!=Retired NOT IP_ADDRESS IN ("0.0.0.0", "255.255.255.255", "127.0.0.1", "169.254.*") earliest=-24h | regex IP_ADDRESS="^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$" | dedup IP_ADDRESS | rename IP_ADDRESS as ip | table ip   I get a total of 22845 IPs. This means that ideally the number of Windows servers in the shadow should be 28806 - 22845 = 5961 So I'm trying to get a similar value with this final search:   index=tenable repository=DISCOVERY sourcetype="tenable:sc:vuln" pluginID=11936 | rex "(?i)Remote operating system : (?P<os>[\D\d]+(?=Confidence level))" | rex "(?i)Confidence level : (?P<os_confidencial_level>[\d]+)" | makemv delim="\n" os | search os=*windows*server* | search NOT [ search index=snow_ci sourcetype=cmdb_ci_server SYS_CLASS_NAME="Windows Server" OPERATIONAL_STATUS!=Retired NOT IP_ADDRESS IN ("0.0.0.0", "255.255.255.255", "127.0.0.1", "169.254.*") earliest=-24h | regex IP_ADDRESS="^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$" | dedup IP_ADDRESS | rename IP_ADDRESS as ip | fields ip ] | table ip dnsName os os_confidencial_level | dedup ip dnsName os   But unfortunately I'm not getting the expected results. I should get the IPs included in the first search but NOT in the second one, not sure why but I'm getting many results (21025) with IPs from the subsearch too. While troubleshooting I have tried this: if at the end of the whole search we look for the IPs that are removed with the subsearch, if the subsearch is working fine, we should get 0 results, which is exactly what I get!   index=tenable repository=DISCOVERY sourcetype="tenable:sc:vuln" pluginID=11936 | rex "(?i)Remote operating system : (?P<os>[\D\d]+(?=Confidence level))" | rex "(?i)Confidence level : (?P<os_confidencial_level>[\d]+)" | makemv delim="\n" os | search os=*windows*server* | search NOT [ search index=snow_ci sourcetype=cmdb_ci_server SYS_CLASS_NAME="Windows Server" OPERATIONAL_STATUS!=Retired NOT IP_ADDRESS IN ("0.0.0.0", "255.255.255.255", "127.0.0.1", "169.254.*") earliest=-24h | regex IP_ADDRESS="^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$" | dedup IP_ADDRESS | rename IP_ADDRESS as ip | fields ip ] | table ip dnsName os os_confidencial_level | dedup ip dnsName os | search [ search index=snow_ci sourcetype=cmdb_ci_server SYS_CLASS_NAME="Windows Server" OPERATIONAL_STATUS!=Retired NOT IP_ADDRESS IN ("0.0.0.0", "255.255.255.255", "127.0.0.1", "169.254.*") earliest=-24h | regex IP_ADDRESS="^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$" | dedup IP_ADDRESS | rename IP_ADDRESS as ip | fields ip ]   So what is the issue here? This is driving me crazy so any help will be really appreciated. Thanks! ... View more