I got the aswer but it shows only one day result 2015-01-02
index=idw source="dbmon-tail://idwarehouse/idw_account" application=SiteMinder lastPasswordChange lastLogon="2015-01-02 10:" owner NOT [search index=idw source="dbmon-tail://idwarehouse/idw_account" application=TFAYD lastPasswordChange lastLogon="2015-01-02 10:" owner] | table owner, lastPasswordChange, application
Can anyone show me how to get 30 days result please