I'm trying to create a dashboard that shows the count of new vulnerabilities between this month and last month, using scan_id as the differentiator.  The vuln data comes in as a csv with asset_id, scan_id, and vuln_id.  The db will have separate queries for unique and total values, based off vuln_id.  My current logic for total vulns is: this_month=count(List of vulns from scan 'x' not in list of vulns from scan 'y') last_month=count(List of vulns from scan 'y' not in list of vulns from scan 'z') index=vulns sourcetype=vuln_scan scan_id = XXXXXX NOT [ search index=vulns sourcetype=vuln_scan scan_id = YYYYYY ] | stats count(vuln_id) as events | eval period=“last_month" | append [ search index=vulns sourcetype=vuln_scan scan_id = YYYYYY NOT [ search index=vulns sourcetype=vuln_scan scan_id = ZZZZZZ ] | stats count(vuln_id) as events | eval period=“this_month”] | fields events, period I feel like there is a much more optimal way to do this, especially since i'm also going to report on persistent and remediated vulnerabilities.  I tried using case (or nested if) to create fields for "this_month", "last_month", and "previous_month", but can't  figure out how to subtract out Y from X without using multiple searches.  The subtraction has to happen before the count, since not all vulns are 'new'.  Any help would be greatly appreciated.  Thanks! ... View more