Finding new IP addresses that haven't been seen before.

[help_me_pls]

Hey,
I have a splunk instance digesting nmap results. Each host that is found on the network generates an event that has information like IP and MAC addresses.

How can I formulate a search that would show me MAC addresses that were discovered for the first time in the last day or so?

I tried doing something like this:

NOT ([search earliest=-30d latest=-1d | table mac]) | table mac ip_address hostname

But that didn't actually remove any hosts that had been seen before.

[richgalloway]

Have you tried a more explicit search?

index=nmap_index earliest=-1d NOT ([search index=nmap_index earliest=-30d latest=-1d | fields mac | format]) 
| table mac ip_address hostname