Get New event and it's count

[patelbhavin2426]

I want to simply get new exceptions that occur within last 30 minutes which did not happened anytime last week on the same day.

I have this query to get exceptions for last weekday. 

earliest=-7d@d latest=-6d@d index=production "java.lang.NullPointerException*" | stats count by field6

Which gives me result :: 

abcd.handler.CreateBankHandler	26
abcd.cr.RequestProcessor	34
abcd.cr.SessionInfo	1
abcd.cr.SSOServlet	2
abcd.impl.ExportManagerImpl	1
abcd.impl.ImportFileProcessor	1

The second query 

earliest=-1d@d latest=now index=production  "java.lang.NullPointerException*" | stats count by field6

Which gives me result :: 

abcd.handler.CreateBankHandler	27
abcd.cr.RequestProcessor	7
abcd.cr.SessionInfo	1
abcd.cr.BaseServlet	6
abcd.cr.SSOServlet

So, the result should be new events from the second query.

Name :: 

abcd.cr.BaseServlet

[ITWhisperer]

earliest=-7d@d latest=-6d@d index=production "java.lang.NullPointerException*" | stats count by field6
| eval count=2
| append
  [ search earliest=-30m@m latest=now index=production "java.lang.NullPointerException*" | stats count by field6
  | eval count=1]
| stats sum(count) as count by field6
| where count=1