I am new to splunk and working on a complex query where; I am supposed to implement NOT IN functionality in SQL along with eval I want to skip all the IN-PROGRESS events who later went into COMPLETED state, and display all the events which are still in IN-PROGRESS state. For example COMPLETED events: event1 event5 event4 event7 IN-PROGRESS events: event3 event1 event4 Expected result event3 Given below are the queries to fetch COMPLETED and IN-PROGRESS events: index=abc message="*COMPLETED*" | eval splitStr=split(message, ",") | eval eventName=mvindex(splitStr,1) | table eventName index=abc message="*IN-PROGRESS*" | eval splitStr=split(message, ",") | eval eventName=mvindex(splitStr,1) | table eventName Thank you in advance. ... View more