Creating a search to take id values from one day, and search for them in the following days

[anthony_copus]

Hi,

I currently need to create a search which takes the id values from a new_user event on 1 day, then searches for if they exist on the following days. The output should be something like:

New Users: 1000
New Users Returning in the 2 days following: 200

I can't figure out how to form the search for this, but in effect I guess it should have this sort of logic:
[index=new_users | fields id] index="other_events" earliest=(selected time + 24h) | stats dc(id) AS count

Can anyone suggest the best query to achieve this?

Thanks,
Anthony

[acharlieh]

I need to play with things on something other than my phone to get the syntax right, but you probably could have 2 subsearches to define earliest and latest for the parent search. You'd likely use addinfo to help drive based on the selected timeframe. Possibly [|noop|stats count|addinfo| eval latest=relative_time(info_max_time,"+2d") | fields latest] [|noop|stats count|addinfo|rename info_max_time AS earliest|fields earliest]