find change in url category.

[abhijeets]

Hello Experts, 

looking for query where i can find  list of urls  blocked today which were allowed yesterday under different category. 

fields-

url, url-category, action (values-allowed, blocked) and time (to compare between yesterday and today)

Thank you advance. 

[richgalloway]

See if this gets you started.

<<your search for events>>
```Determine if the event is from today or yesterday ```
| eval day=if((now() - _time) >= (now() - relative_time(now(), "@d")),"today", "yesterday")
```Keep the most recent event today and yesterday for each URL
| dedup url, day
```List the actions for each URL```
| stats list(action) as actions, values(*) as * by url
```Keep the events with different actions
| where mvcount(actions) = 2
```Keep the events where the first action is 'allowed' and the second is 'blocked'```
| where (mvindex(actions,0)="allowed" AND mvindex(actions,1)="blocked")