Query :
index="heroku_secure_uat" host="messaging-service-uat.herokuapp.com" [search event_name=email OR event |where NOT LIKE(person_id,"%WF%")| stats dc(person_id)]| rex "(?\{.*)" | spath input=json_data
Result :
172cd733-beec-490f-8f53-dbe68166bb33
3874287d5dfb468187f5a42251214d15
40c5778a-152c-40db-bf85-24c8aec427de
5678c76c-e689-4712-a8fb-85e5e0c5097f
618bd8ea-59dc-485f-a0a3-908adb804443
6618bb54-73fd-4d13-b2e2-72e18171a904
6f196d9397a64b0cb62196efd1d82309
724ad888-cbd4-483f-91b3-01a95809ad7b
9bd90012-f4e8-4bc2-b149-d63219aab343
9e9f0ec6-899e-43a8-b1e3-ca158516b6fe
WF-172cd733-beec-490f-8f53-dbe68166bb33\u0026token=-YIg4amu7FD76T2XGfd2-w
WF-5678c76c-e689-4712-a8fb-85e5e0c5097f\u0026token=CycW6z87l5wFBjPlSQ2anQ
WF-5678c76c-e689-4712-a8fb-85e5e0c5097f\u0026token=fqlqHuY284bpCU180o3jLw
WF-5678c76c-e689-4712-a8fb-85e5e0c5097f\u0026token=hDLTqEqQwAabP5bXaqajJA
WF-5678c76c-e689-4712-a8fb-85e5e0c5097f\u0026token=jU7sWgFiyNJ6DeYFp5kkhA
WF-5678c76c-e689-4712-a8fb-85e5e0c5097f\u0026token=ta-NduNrMOUGqjbPUMbACA
WF-bdd32edb-7ec0-43ca-9457-2fe6f74c294a\u0026token=aE1qDEBT0AE0tneHlyHecA
b800274d-d134-48d9-973f-0c9361a615a6
bdd32edb-7ec0-43ca-9457-2fe6f74c294a
I need to use this above result again in same query to get those records count which are not starting with "WF-".
Please suggest .
Any help will be appreciated.
... View more