Given a field containing a "userId", I want a count per day of unique userIds by "new" vs "returning". E.g. Ends up with this output... | timechart span=1d dc(userId) by newOrReturning or I suppose... | bin _time span=1d | stats dc(userId) by _time, newOrReturning A userId is "new" on a given day if there is no record of it from any previous day, going as far back as a known fixed date. The bit I'm having trouble with is how to set newOrReturning, since (I assume) I need to somehow search back in time for a matching userId from previous days. ... View more

I have a search that displays unique users per day (based on a "user id" field). I also would like another search that displays "new" unique users per day, looking back to some fixed date. I suspect maybe I need a sub-search using "earliest" and "latest", but I don't know how to put it together. ... View more