Splunk Search

Get New event and it's count

patelbhavin2426
Observer

I want to simply get new exceptions that occur within last 30 minutes which did not happened anytime last week on the same day.

I have this query to get exceptions for last weekday. 

 

 

 

earliest=-7d@d latest=-6d@d index=production "java.lang.NullPointerException*" | stats count by field6

 

 

 

Which gives me result :: 

 

abcd.handler.CreateBankHandler26
abcd.cr.RequestProcessor34
abcd.cr.SessionInfo1
abcd.cr.SSOServlet2
abcd.impl.ExportManagerImpl1
abcd.impl.ImportFileProcessor1
  

 

The second query 

 

 

 

earliest=-1d@d latest=now index=production  "java.lang.NullPointerException*" | stats count by field6

 

 

 

 

Which gives me result :: 

abcd.handler.CreateBankHandler27
abcd.cr.RequestProcessor7
abcd.cr.SessionInfo1
abcd.cr.BaseServlet6
abcd.cr.SSOServlet 

 

So, the result should be new events from the second query.

Name :: 

abcd.cr.BaseServlet

 

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
earliest=-7d@d latest=-6d@d index=production "java.lang.NullPointerException*" | stats count by field6
| eval count=2
| append
  [ search earliest=-30m@m latest=now index=production "java.lang.NullPointerException*" | stats count by field6
  | eval count=1]
| stats sum(count) as count by field6
| where count=1
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>