I currently need to create a search which takes the id values from a new_user event on 1 day, then searches for if they exist on the following days. The output should be something like:
New Users: 1000
New Users Returning in the 2 days following: 200
I can't figure out how to form the search for this, but in effect I guess it should have this sort of logic:
[index=newusers | fields id] index="otherevents" earliest=(selected time + 24h) | stats dc(id) AS count
Can anyone suggest the best query to achieve this?
I need to play with things on something other than my phone to get the syntax right, but you probably could have 2 subsearches to define earliest and latest for the parent search. You'd likely use addinfo to help drive based on the selected timeframe. Possibly [|noop|stats count|addinfo| eval latest=relative_time(info_max_time,"+2d") | fields latest] [|noop|stats count|addinfo|rename info_max_time AS earliest|fields earliest]