How can i list missing and new events ?

[rsoufiane]

Hello,

Every day Splunk forwarders collect different types of system events (warnings,errors,informations, criticals) from machines. These events are constantly changing: a new one appears, others disappear and some stay.

What i want to do is count the number of missing/new events for every day and list them in a table by their ID and type.

Thanks in advance

[rsoufiane]

Exaclty. in comparison with yesterday i want a table with the missing and new events

[somesoni2]

So when you want to compare, do you want to compare against yesterday (e.g. list all events that came yesterday but not today etc)?