Splunk Search

Get New event and it's count

patelbhavin2426
Observer

I want to simply get new exceptions that occur within last 30 minutes which did not happened anytime last week on the same day.

I have this query to get exceptions for last weekday. 

 

 

 

earliest=-7d@d latest=-6d@d index=production "java.lang.NullPointerException*" | stats count by field6

 

 

 

Which gives me result :: 

 

abcd.handler.CreateBankHandler26
abcd.cr.RequestProcessor34
abcd.cr.SessionInfo1
abcd.cr.SSOServlet2
abcd.impl.ExportManagerImpl1
abcd.impl.ImportFileProcessor1
  

 

The second query 

 

 

 

earliest=-1d@d latest=now index=production  "java.lang.NullPointerException*" | stats count by field6

 

 

 

 

Which gives me result :: 

abcd.handler.CreateBankHandler27
abcd.cr.RequestProcessor7
abcd.cr.SessionInfo1
abcd.cr.BaseServlet6
abcd.cr.SSOServlet 

 

So, the result should be new events from the second query.

Name :: 

abcd.cr.BaseServlet

 

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
earliest=-7d@d latest=-6d@d index=production "java.lang.NullPointerException*" | stats count by field6
| eval count=2
| append
  [ search earliest=-30m@m latest=now index=production "java.lang.NullPointerException*" | stats count by field6
  | eval count=1]
| stats sum(count) as count by field6
| where count=1
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...