A search like this I think will do it. (Set your search window to be last 7 days)       index=<origin_index> Operation="FileUploadedToCloud" earliest=-7d latest=now | stats count as upload_count, earliest(_time) as earliest_upload_epoch, latest(_time) as latest_upload_epoch by user, targetdomain | sort 0 -upload_count | stats dc(user) as dc_user, list(user) as users, min(earliest_upload_epoch) as earliest_upload_epoch, max(latest_upload_epoch) as latest_upload_epoch, list(upload_count) as upload_count, sum(upload_count) as total_upload_count by targetdomain ``` filter down results to only include domains where 1 user has uploaded in the specified search window ``` | where 'dc_user'==1 | convert ctime(earliest_upload_epoch) as earliest_upload_timestamp, ctime(latest_upload_epoch) as latest_upload_timestamp | fields - *_upload_epoch         This should also return results if a single user has uploaded to a domain multiple times but is still the only user to upload to it in the last 7 days. Resulting dataset would look something like this. If scope needs to be narrowed to only 1 upload event by a user then you can additional filter to only return the events where 'total_upload_count'==1