Splunk Search

Find all newer events logged by application after a certain date

New Member

Question: How can we find diff between log statements before and after a given date. 
Applicability:  Let's say we release a new application code and I want to be able to see all new events that application has started logging. 

Now definition of new is very vague here but any suggestion would help.  Idea is that splunk should be able to compare type of events were being logged earlier and only show new events that were not present before. 

That would help finding any new Exceptions Errors or Warning that are being logged and not yet surfaced as a failed customer interaction. 

Example:  After a new code release,  our application started logging an WARN event regarding "open file handlers" that kept building up over the time and ultimately reached a stage where no more unix file handlers were available to process any new request. 

Labels (1)
0 Karma


You could try dedup which will pick the first occurrence of each value so any occurrence that is after the release date must be new to that release

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...