There are a few ways to potentially solve this, but realize that looking for something that doesn't exist is not a great situation.
I think I would evaluate it with a case statement, because later on, it allows you at add additional conditions if needed.
I might go with something similar to:
index=servers
| eval ServerType=case(
EventID = "XYZ","not_wanted_servers",
1=1, "target_servers"
)
| where ServerType="target_servers "
We are evaluating ( eval command) your servers into Server types: ones not wanted and ones targeted.
EventID="XYZ" is to be called not_wanted_servers, and everything else is to be called target_servers.
Then we use the where , so only look for the targeted ServerType, target_servers.
... View more