Track Useragent Change Over Time

[agodoy]

So I have two searches that return the list of useragents.

Search 1 Current Week:

host="webserver" | earliest=-1w latest=now | stats count by useragent | table useragent, count | sort - count

Search 2 Last Week:

host="webserver" | earliest=-2w latest=-1w | stats count by useragent | table useragent, count | sort - count

These will return a list of useragents for the time frames indicated. How do I display the useragent that are new from the Last Week search?

Thanks!

[lguinn2 · Accepted solution]

Try this

host="webserver" earliest=-1w latest=now 
| stats count as ThisWeek by useragent
| join useragent type=outer [ search host="webserver" earliest=-2w latest=-1w 
    | stats count as LastWeek by useragent ]
| fillnull
| where LastWeek = 0
| sort -ThisWeek

[agodoy]

That worked. Thank you!