You can fetch results of lookup using search: | inputlookup your_lookup.csv Replacing lookup data would be: ```your search here``` | outputlookup your_lookup.csv And then you can add(append) rows using: ```your search here``` | outlookup append=true your_lookup.csv ... View more

You need historic data of users to compare. You would need to configure Assets&Identities or save users to simple lookup. You can store results daily, weekly, monthly using this search: index=your_users_index ``` Add or configure neccessary fields | eval bunit="your_bunit", startDate=strftime(now(),"%Y-%m-%d %H:%M:%S"), | stats count by email, identity, nick, UserId, "first", "last", JobTitle, phone, bunit, work_country, work_city, startDate | table email, identity, nick, UserId, "first", "last", JobTitle, phone, bunit, work_country, work_city, startDate | search NOT [| inputlookup users.csv | fields email ] | outputlookup append=true users.csv And later you can sort users startDate using this search: | inputlookup users.csv | sort - startDate Or get last month's new users: | inputlookup users.csv | eval epoch=strptime(startDate, "%Y-%m-%d %H:%M:%S") | where epoch>relative_time(now(), "-20d") ... View more