Thanks Musskopf!
So, let's see if I understand correctly -
--
index=my_index AND AppName="A" -- finding the users that use app "A"
[ search index=my_index AppName="B" | dedup UID | fields UID ] -- find all users using app "B", remove duplicates, strip all other fields
--
index=my_index AND AppName="A" AND NOT [ search index=my_index AppName="B" | dedup UID | fields UID ]
This combination I'm a little confused about, but if I'm correct this is saying 'if a given item is in the app "A" group, AND NOT in the app "B" group?
--
Then you take all of it, strip the duplicates, and make a table.
... View more