https://community.splunk.com/t5/Splunk-Search/Track-Useragent-Change-Over-Time/m-p/106572#M27725 <P>That worked. Thank you!</P> Fri, 01 Feb 2013 15:17:28 GMT agodoy 2013-02-01T15:17:28Z https://community.splunk.com/t5/Splunk-Search/Track-Useragent-Change-Over-Time/m-p/106570#M27723 <P>So I have two searches that return the list of useragents.</P> <P>Search 1 Current Week:</P> <PRE><CODE>host="webserver" | earliest=-1w latest=now | stats count by useragent | table useragent, count | sort - count </CODE></PRE> <P>Search 2 Last Week:</P> <PRE><CODE>host="webserver" | earliest=-2w latest=-1w | stats count by useragent | table useragent, count | sort - count </CODE></PRE> <P>These will return a list of useragents for the time frames indicated. How do I display the useragent that are new from the Last Week search?</P> <P>Thanks!</P> Thu, 31 Jan 2013 15:57:03 GMT https://community.splunk.com/t5/Splunk-Search/Track-Useragent-Change-Over-Time/m-p/106570#M27723 agodoy 2013-01-31T15:57:03Z https://community.splunk.com/t5/Splunk-Search/Track-Useragent-Change-Over-Time/m-p/106571#M27724 <P>Try this</P> <PRE><CODE>host="webserver" earliest=-1w latest=now | stats count as ThisWeek by useragent | join useragent type=outer [ search host="webserver" earliest=-2w latest=-1w | stats count as LastWeek by useragent ] | fillnull | where LastWeek = 0 | sort -ThisWeek </CODE></PRE> Thu, 31 Jan 2013 18:24:47 GMT https://community.splunk.com/t5/Splunk-Search/Track-Useragent-Change-Over-Time/m-p/106571#M27724 lguinn2 2013-01-31T18:24:47Z https://community.splunk.com/t5/Splunk-Search/Track-Useragent-Change-Over-Time/m-p/106572#M27725 <P>That worked. Thank you!</P> Fri, 01 Feb 2013 15:17:28 GMT https://community.splunk.com/t5/Splunk-Search/Track-Useragent-Change-Over-Time/m-p/106572#M27725 agodoy 2013-02-01T15:17:28Z