lookuptable compare with new event

[Satsan]

I called all the errors and created to lookup-table. I want to create a job which would compare the last 5 minutes of errors with errors in lookup-table . If it doesn't match it would trigger an alert ( means finding new error from existing)

Can we do this via Splunk query ? , if so can you please share the sample query

[Shan]

@Satsan,

Give a try with below answer..
You need to get the values from index which are not already available in lookup already. So when you get a new error alert can be triggered.

https://answers.splunk.com/answers/426035/search-for-items-not-matching-values-from-a-lookup-1.html

[Satsan]

Thank you, i will go ahead and try