How to develop a search to find auditing activity that began on a specific date?

[digital_alchemy]

Scenario:

We have auditing activity that began on a specific day. I would like to search the firewall logs for activity from src_ip addresses that do not exist in the logs prior to that date for at least a couple of months.

Any suggestions on how to specify that I only want the results of new IP addresses seen for the first time during a specific timeframe?

[somesoni2 · Accepted solution]

One long running slow version, could be like this (assuming specific date is Jan 2nd 2017)

your base search spanning 2 months of time range | stats min(_time) as firstReceived by src_ip | where firstReceived >=strptime("2017-01-02","%Y-%m-%d")

[digital_alchemy]

Thanks, that works perfectly... and such a simple solution.