How to edit my search to get new errors from today, and that not occurred in last 7 days?

[manjulanam]

Can you please help with the following search? It returns 0 events. I want all the errors that occurred today, and not in last 7days

sourcetype="xx" source="err.log" error earliest=-1d@d  
| stats count AS thisweek by _Error  
| appendcols [ search  source="err.log" error earliest=-7d@d latest=-1d@d
| stats count AS lastweek by _Error]
| where  !isnum(lastweek)
| table thisweek lastweek _Error

Thank you!

[lguinn2 · Accepted solution]

I wouldn't use appendcols for a start. Use append instead, and a final stats to combine the two

sourcetype="xx" source="err.log" error earliest=-1d@d  
| stats count AS thisweek by _Error  
| append [ search  source="err.log" error earliest=-7d@d latest=-1d@d
      | stats count AS lastweek by _Error]
| stats first(*) as * by _Error
| where thisweek > 0 and lastweek = 0

You could also do this with no sub-searches at all, which may be necessary if you are working with very large data sets:

sourcetype="xx" source="err.log" error earliest=-7d@d  
| eval category = if(_time < relative_time(now(),"-1d@d"),"last week","this week")
| stats count(eval(category=="this week")) AS thisweek count(eval(category=="last week")) AS lastweek by _Error  
| where thisweek > 0 and lastweek = 0

[manjulanam]

Thank you Iguinn!, I tried both of the search queries you recommended, but still get No results found.
The original search I posted, returns results if the lastweek query is within last 2 days, but for 7days it almost seems like finalizing results and returns no results

[manjulanam]

I used your query with no subsearches replaced or with following and it worked!!
Thank you very much, really appreciate your help!!

| table thisweek lastweek _Error
|where lastweek = 0