I currently have a search set up to identify an individual error clustered to show the total count, detail and last seen timestamp output into a CSV table over all time. This search is scheduled to run/update weekly.
My goal is to use this as a refrence point whereby I can run an identical search across a period of a week / day to cross reference if the individual error has ever been seen before from the all time csv i.e. a true new error.
I have attempted various lookup's however am now stuck for a way on how to work it.