Looking for new events

[richnavis]

Good Day Everyone,

I"m trying to construct a search that will search our weblogs over a one hour period and report on IP addresses that didn't appear in the first half hour. I would like to display the sum of new IPs in a timechart. The approach I'm started to take is to search the hour, create 1 minute buckets, group by IP address, and add a column that indicates if it was first half or second half of the hour so the data now looks something like this..
Time IP &nbsp Count Group
08:00 10.10.10.10 20 First
08:01 10.10.10.10 27 First
08:00 10.10.10.11 3 First
.....
08:32 10.10.10.11 79 Second
08:33 10.10.10.14 11 Second
08:34 10.10.10.14 44 Second
...

So, now I'm trying to Create a TimeChart that includes ALL values from first group, and ONLY IPs in the second group that aren't included in the first group. This is where I'm stumped.

[woodcock]

Like this:

... | eval date_minute = strftime(_time, "%M") | eval FirstOrSecond=if((date_minute>=30), "Second", "First") | eventstats dc(FirstOrSecond) AS numHalves BY IP | where FirstOrSecond="First" OR (FirstOrSecond="Second" AND numHalves=1) | timechart ...

[jensonthottian]

index=abc earliest=-60m latest=-31m |table _time IP |eval Group=First | join _time [search index= abc NOT [search index=abc earliest=-60m latest=-31m |dedup IP| table IP] earliest=-30m latest=now |table _time IP|eval Group=Second]| table _time Group

This should give you result from group 2 avoiding IP's from first group.