It isn't of much use, as this just tends to show the same information with every delivery (as it should).
What I'd like to do is produce a report that compares one day to the next and list differences. This would help answer questions like: Did the hash for c:\windows\system32\svchost.exe change? Is there an svchost.exe that has a different hash than one seen before?
I'd love to get to a point where I could have real time alerting:
when the Hash changes but Image stays the same (and correlate to a Windows Update within some period of time).
when a ParentImage changes, but Image stays the same (at least for system processes)
You could do a subsearch where your search and subsearch are basically the same thing with the subsearch having earlier and latest defined in it so you can time bound that search on a different subset of the data. From there, you would use the join type=left (or outer, they work the same way) .
I will caveat this to say I haven't test this and you may need to rearrange the searches to get the outer join to return the data you want. In fact you may end up having a couple of searches to match the permutations, but hopefully this is a start.
Not sure if you were also looking to make that daily report a lookup but if so, you canuse the | outputlookup to write each day into a lookup and then use the | inputlookup to take the previous day value and compare to today's value.