Compare events that are a minimum time range apart.

[hems03]

I need to calculate the difference between a field in the most recent event with a given account_id and the latest event that is atleast a week before this one.

 06/24/2018 02:45:57 PM
 AccountId=foo
 LogName=Security
 COMPARED_FIELD=0
 EventCode=4624
 EventType=0
 Type=Information 
 host=host1

 07/01/2018 03:45:57 PM
 AccountId=foo
 LogName=Security
 COMPARED_FIELD=1
 EventCode=4624
 EventType=0
 Type=Information 
 host=host1

We want to see if this field changes over the span of a week. What would be the best way of doing this?

[woodcock]

Like this:

Your Base Search Here
| streamstats time_window=7d values(COMPARED_FIELD) dc(COMPARED_FIELD) num_values range(COMPARED_FIELD) BY AccountId
| where num_values>1