Count New IPs Accessed Over Time

[ky129q]

We have a daily report that generates an event each time an IP is accessed each day.  In order to determine the number of new IPs accessed today that have never been accessed before we use the following query:

sourcetype=report_900 earliest=-1d@d latest=now NOT 
    [search sourcetype=report_900 earliest=1 latest=-1d@d 
    |  stats count by IPv4Address 
    | table IPv4Address] 
| stats count by IPv4Address
| table IPv4Address
| stats count

What we would like to have is a query that produces a timechart of the the number of new IPs accessed each day.

If the data shows the following IP access for the day  (each letter represents a different IP)

2021/01/01 IPs:  A,B,C,A,A

2021/01/02 IPs: B,D,E,B,E

2021/01/03 IPs: A,D,E,A,A

2021/01/04 IPs: B,C,F,C

We would get the following results:

2021/01/01     3

2021/01/02     2

2021/01/03     0

2021/01/04     1

Any suggestions on how this can be accomplished?

Also, any suggestions on improving the performance of our original query?

[ITWhisperer · Accepted solution]

sourcetype=report_900 earliest=1 latest=now
| bin _time span=1d
| stats values(IPv4Address) as IPv4Address by _time
| streamstats dc(IPv4Address) as countip
| streamstats window=1 current=f values(countip) as previouscount
| fillnull value=0 previouscount
| eval change=countip-previouscount

[ky129q]

Exactly what I wanted.  Thanks