How to search the list of devices that have sent logs the past 30 days, but not within the last 24 hours?

[sumit29]

Dear Experts,

I am looking to find the difference in the devices sending logs in the last 24 hour with devices which sent logs 30 days back.

Search:

| tstats values(host) AS Host dc(host) as count by sourcetype,index | eval sourcetype=sourcetype." - ".count | stats list(sourcetype) as "sourcetype-hostCount" by index, Host 

Lets say for the ast 24 hours, it list 40 devices, and for last 30 days it list 60 devices.

I need an output of the difference which should list the 20 devices which are not sending logs from the past 1 day.

[lguinn2]

Try this

| tstats count latest(_time) as latest by host sourcetype index
| eval last24hours=if(latest>=relative_time(now(),"-24h"),"Yes","No")
| eval last30days=if(latest>=relative_time(now(),"-30d"),"Yes","No")
| where last30days="Yes" and last24hours="No"
| stats list(sourcetype) as sourcetypes list(count) as counts sum(count) as Total by index host