How to get the new errors that don't appear yesterday?

[Jackiifilwhh]

Hi everyone! We want to get the new errors that don't appear yesterday. For example, if an action named A. Its yesterday's error codes are A1, A2, A3. But its today's error codes are A1, A2, A4, A5. A4 and A5 are new errors. The fields we use in Splunk is below:

application: the name of an application
transId: the name of an action in our system
errorCode: the error code of an action once an exception occurred

The result we want to get for the example above is like below:

application	transId	errorCode
exp	A	A4
exp	A	A5

I've tried subsearch but it doesn't work well! Subsearch will be auto-finalized after 60s!

[ITWhisperer]

Something like this (you will need to set up day and today - if you need help with that, just ask)

| stats values(day) as day by errorcode
| where mvcount(day)=1 AND day=today

[Jackiifilwhh]

you will need to set up day and today

Does it use relative_time()?

[ITWhisperer · Accepted solution]

It doesn't have to - assuming _time is the time of the event, you could do this (amongst other approaches)

| eval day=strftime(_time,"%F")
| eval today=strftime(now(),"%F")

[Jackiifilwhh]

What you have benefited me deeply is your train of thought! It seems work well! Finally I want ask you a question: why don't you recommend me to use relative_time(). Is it inefficient? It's convenient to compare two time span.

[ITWhisperer]

I didn't say don't use relative_time, I was just suggesting an alternative. Both are valid. I am unsure of their relative efficiencies but I suspect there may not be much between them.