I was able to get the required data by making TaskID a multi-value field and then finding the values that do not exist in TaskIDHistoric.
This seems to work ok...
host="A*" SourceName="Task" earliest=@d
| stats values(TaskID) as TaskID
| appendcols [search host="A*" SourceName="Task" earliest=-7d@d latest=-1d@d
| stats values(TaskIDHistoric) as TaskIDHistoric ]
| makemv TaskID
| mvexpand TaskID
| where not match(TaskIDHistoric, TaskID)
| table TaskID
If there is a more efficient/better way of doing this, I'd love to know.
... View more