So figure out how to do this (was not easy). You have to eval a test field with some unique host ID and the timestamp and then negate the transaction results based on that - putting the new test field together inside of the subsearch and outside of it before you do the subsearch: index=windows* EventCode=1 | eval TESTFIELD=ip_address._time | search NOT [ search index=windows* (EventCode=1 OR EventCode=2 OR EventCode=3) | transaction ip_address startswith=EventCode=1 endswith=(EventCode=2 OR EventCode=3) maxspan=12m | eval TESTFIELD=ip_address._time | fields TESTFIELD | table TESTFIELD ] | fillnull value=NULL | table ip_address EventCode host _time TESTFIELD ... View more