I'm trying to write a search to highlight users that have caused multiple notables over time. Using the search below, I can get a list of which users created notables each day. I'd like to modify the search to show users that have notables in more than one day period over the past 30 days. i.e. UserA created a notable on the 1st and the 2nd. Basically looking for repeat offenders. Any ideas?
notable | search NOT suppression |timechart count by user usenull=f useother=f
I think I answered my own question. It's sort of a weird way to get the info, but I think this is accurate.
notable | search NOT suppression AND NOT rule_title=VPN |eval mytime=strftime(_time, "%Y%m%d") | makemv delim=" " user | mvexpand user |eval user=lower(user)| stats values(mytime) as Dates by user | stats count(Dates) as Number by user | where Number>=2 | rename Number as "Number of Days"| sort - "Number of Days"