Getting Data In

Find new errors

splunk13
Explorer

Hi all,

I want to see the new errors after a date, per example "new errors after 1 day ago". I've created this request, which works fine for find the first occurrence of each error. But now I want filter the result of my request to find the new errors for this day. How can I do that ?

("SourceName=Application Popup" OR
Type=Critical OR Type=Warning)
host="xxxx" | reverse | dedup Message | { I want filter date here }

Thanks for your help !

Tags (4)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can filter events by time at a later point in your query like this:

... | where _time >= relative_time(time(), "@d")

This will only keep events from today.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can filter events by time at a later point in your query like this:

... | where _time >= relative_time(time(), "@d")

This will only keep events from today.

splunk13
Explorer

Hi sonicant,

Yes but the result of you request isn't the objective.
I want see the today's errors who have never appeared before today. And your request show all distinct errors for today.

Thank you for your help and sorry if I'm not very clear.

Regards,

0 Karma

sonicant
Path Finder

Hi splunk13

You may not use "earliest=" after the pipe, please add it into the first part of your search, like this:
("SourceName=Application Popup" OR Type=Critical OR Type=Warning) host="xxxx" earliest=@d | reverse | dedup Message

0 Karma

splunk13
Explorer

Hi,
Thank you for your fast response.
I mean the today's errors who have never appeared before.
So I just need filter the result of my request to show only errors who appeared today.

Like:
("SourceName=Application Popup" OR Type=Critical OR Type=Warning) host="xxxx" | reverse | dedup Message | earliest=-1d@d

But it doesn't work.

Regards,

0 Karma

yannK
Splunk Employee
Splunk Employee

The dedup will remove all the events except the first one, so in your case you should remove it.

what about the list of errors per day
mysearch | timechart span=1d count by Message

Or simply a statistical count of errors with the detail of the first and last occurrence
mysearch ealiest=-1d@d | stats last(_time) as oldesttime last(_time) as recenttime count by Message | convert ctime(oldesttime) | convert ctime(recenttime)

0 Karma

sonicant
Path Finder

if you mean "new errors today" and you can accept filter date at the beginning of the search command, you may add "earliest=@d" for today or "earliest=-2d@d" for today and yesterday, into the first part of search command.
Like this:
("SourceName=Application Popup" OR
Type=Critical OR Type=Warning)
host="xxxx" earliest=@d | reverse | dedup Message

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Note, -2d@d refers to today, yesterday and the day before yesterday. You'd get today and yesterday with -d@d.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...