compare results of two searches to detect new activity

[dbylertbg]

How do I compare two searches to find values that exist in one search but not the other? For example, how do I report on users who have logged in today who haven't logged in for the previous 6 months?

If I have a search that lists every user to log in to a system, I can run that search over the previous 6 month period excluding today (earliest=-6m, latest=@d) to get my historical list, and run it again for just today (earliest=@d, latest=now) to get today's list, but I'm stuck figuring out how to compare the lists for values unique to today's list: I want to see if there are any users who logged in today that haven't logged in during the previous 6 months.

[jonuwz]

You don't need to join searches to do that.

Just search over the last 6 months, get the earliest login time on record, and if that time is within the last 24 hours, today is the 1st time they logged in in 6 months

earliest=-6mon ... | stats min(_time) as _time by user | where _time > now() - 86400

[jonuwz]

how many rows has it scanned, and how frequently are you going to be doing this ?

[dbylertbg]

Thanks, that makes sense. Don't know why I always forget about the _time field... 🙂

My test search is still running (started it right after you posted, thanks for the quick response!) and it seems to be working: My results list started by increasing and increasing (as expected, as it searched through the past 24 hours and found everyone to log in within the past 24 hours) and is now decreasing and decreasing as (I presume) it finds earlier logons for various users.