This is one of the approaches. Another one would be to list all data and categorize it, then summarize and pick only matching ones. So in your case you probably can do something like <your_search> earliest=-30d to list all events and | eval state=if(_time<now()-86400,"old","new") to categorize it. But this approach will work only because you have a single "type of search" and only the time differs so the events are easily distinguishable. In more complicated case you can use another approach: <your search> earliest=-30d latest=-24h | eval state="old" | append      [ <your search> earliest=-24h | eval state="new" ] Of course this one has limitations from the append command so you might use multisearch instead. Anyway. As you now have your search results, you can stats them | stats values(state) by answer so you know whether each answer is included in the old or new set. Now all that's left is to filter the result to only see those you want. For example if you want only those that are in the "new" period, but not in the "old" one you simply do | where state="new" AND NOT state="old" One caveat - matching multivalued fields can be a bit unintuitive since a condition is matched on each value from the mvfiled separately so | where state="new" AND state!="old" is a completely different condition (and I'll leave it as an exercise for the reader to find out what it matches).