I use dedup instead of subsearches to identify New (over 'All time' range) or Infrequent (over 'Last X days' range) event types, for example:
sourcetype=WinEventLog* | dedup host, LogName, SourceName, EventCode sortby +_time | eval epochevent=_time | eval epochwindow=relative_time(now(), "-1d" ) | where epochevent>=epochwindow | table host, LogName, SourceName, EventCode, Message, _time
Change "-1d" in the search to narrow or broaden the differential range and schedule your alert to the same frequency.
... View more