So I have two searches that return the list of useragents.
Search 1 Current Week:
host="webserver" | earliest=-1w latest=now | stats count by useragent | table useragent, count | sort - count
Search 2 Last Week:
host="webserver" | earliest=-2w latest=-1w | stats count by useragent | table useragent, count | sort - count
These will return a list of useragents for the time frames indicated. How do I display the useragent that are new from the Last Week search?
Thanks!
Try this
host="webserver" earliest=-1w latest=now
| stats count as ThisWeek by useragent
| join useragent type=outer [ search host="webserver" earliest=-2w latest=-1w
| stats count as LastWeek by useragent ]
| fillnull
| where LastWeek = 0
| sort -ThisWeek
Try this
host="webserver" earliest=-1w latest=now
| stats count as ThisWeek by useragent
| join useragent type=outer [ search host="webserver" earliest=-2w latest=-1w
| stats count as LastWeek by useragent ]
| fillnull
| where LastWeek = 0
| sort -ThisWeek
That worked. Thank you!