Search in logs if value appeared before?

[suspense]

Hello, Good Day!

I have mail logs and I need to check if sender appeared before in last 30 days.

I have issues with write SPL with join or subsearch.

index=* sourcetype=maillogs

field that I want to compare is sender. If sender appeared in last 30 mails, then I have match and I should see those events in stats or table.
I tried subsearch but after all attempts I ended with nothing. Could you please help me?

[suspense]

Thanks. What I need is to search within logs last 24 hrs and check if sender which appeared in such logs appared before within last 30 days (but without the latest 5 days)

index=* sourcetype=maillogs
| eventstats count by sender
| where count > 1 
| rest of my SPL

Where to put earliest=-30d@d latest=-5d@d ? 

[ITWhisperer]

Try something like this

index=* sourcetype=maillogs (earliest=-30d@d latest=-5d@d) OR (earliest=-24h)
| eventstats earliest(_time) as earliest_time latest(_time) as latest_time by sender
| where earliest_time < relative_time(now(),"-24h") AND latest_time >= relative_time(now(),"-24h")

[ITWhisperer]

| eventstats count by sender
| where count > 1