Looking for new events

Good Day Everyone, I"m trying to construct a search that will search our weblogs over a one hour period and report on IP addresses that didn't appear in the first half hour. I would like to display the sum of new IPs in a timechart. The approach I'm started to take is to search the hour, create 1 minute buckets, group by IP address, and add a column that indicates if it was first half or second half of the hour so the data now looks something like this.. Time IP &nbsp Count Group 08:00 10.10.10.10 20 First 08:01 10.10.10.10 27 First 08:00 10.10.10.11 3 First ..... 08:32 10.10.10.11 79 Second 08:33 10.10.10.14 11 Second 08:34 10.10.10.14 44 Second ... So, now I'm trying to Create a TimeChart that includes ALL values from first group, and ONLY IPs in the second group that aren't included in the first group. This is where I'm stumped.