I need some assistance with constructing a search to help identify machines with reoccurring infections. I thought that I could basically look for any machine logs that show infections with a _time greater than 1 hour. I am having difficulty trying to apply the diff or delta command with relation to computer. It would be great to have something like delta _time AS timeDelta by Computer, so that it would only run the delta on the _time from the same Computer. As it is now, it is running the delta or diff from the last log without any consideration for computer.
If anyone has any suggestions on how to accomplish this, or another way of identifying reoccurring infections, please let me know.
Thanks
