First of all, be careful with the word "event" when talking about Splunk search because if you use tstats, you cannot retrieve what Splunk defines as an "event". So, I assume that your events carries an identifying field, say "eventID", and that you want to find which eventID's exist in the 90-day search but not in the 30-day search. Is this correct?
For this, you can do something like
| tstats count where earliest=-30d by eventID | eval thisis = "30day" | append [| tstats count where earliest=-90d by eventID | eval thisis = "90day"] | stats values(thisis) as thisis by eventID | where mvcount(thisis) == 1 AND thisis == "90day"
Hope this helps.
thanks for the reply! I am doing it for hosts to see which are missing.
In that case, host field is "eventID"