Thanks for the suggestion. I tried adding this to my search, but had to add a "d" to "appencols". It keeps telling me that whatever follows "appendcols" is an unknown search command ("Unknown search command 'sourcetype'").
Here's the updated search:
sourcetype="Login" earliest=-1w@w0 latest=@w
| stats count as week1 by host
| eventstats dc(host) as distinct_hosts by UserName, Event, Authentication
| where distinct_hosts >= 15
| dedup host, TargetUserName, AuthenticationPackageName
| stats dc(Computer) by UserName, Event, Authentication
| appendcols [sourcetype="Login" earliest=-1w@w0 latest=@w
| stats count as week2 by host
| eventstats dc(host) as distinct_hosts by UserName, Event, Authentication
| where distinct_hosts >= 15
| dedup host, UserName, Event, Authentication
| stats dc(Computer) by UserName, Event, Authentication]
| eval diff=week2-week1
... View more