I want to know if an account is being accessed by two or more countries within a certain timeframe (for example within twelve hours an account was being accessed by country1 and country2). However, I want to be able to run this search over a 6 month time period. (In the last six months here are the users who were, at some point, accessed by two different countries within twelve hours).
NOTE: I am using the geolocation app powered by maxmind.
Currently I am using stats to count the number of countries a user is accessed from and then displaying results where the country count is greater than one. However, I don't care if a user is accessed from two countries over a 6 month time period. And I don't want to have to run the search over a 12 hour time period over and over again until I've gone back 6 months.
I am assuming that I will use the transaction command and use maxspan to set the timerange that I want. However, I'm not sure how to fit that in with the rest of my search.
Any suggestions?
Thanks
