Splunk Search

Find all newer events logged by application after a certain date

serach2learn
New Member

Question: How can we find diff between log statements before and after a given date. 
Applicability:  Let's say we release a new application code and I want to be able to see all new events that application has started logging. 

Now definition of new is very vague here but any suggestion would help.  Idea is that splunk should be able to compare type of events were being logged earlier and only show new events that were not present before. 

That would help finding any new Exceptions Errors or Warning that are being logged and not yet surfaced as a failed customer interaction. 

Example:  After a new code release,  our application started logging an WARN event regarding "open file handlers" that kept building up over the time and ultimately reached a stage where no more unix file handlers were available to process any new request. 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try dedup which will pick the first occurrence of each value so any occurrence that is after the release date must be new to that release

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...