I would like to get the errors by class/exception/ExceptionMessage field (java based application errors) by week over week comparison. I checked timewrap but didn't fit in my requirement or I couldn't complete the query. This query is based on ExceptionMessage in my application java log. (index=MYINDEX1 OR index= MYINDEX2) level=ERROR earliest=-1h@h latest=now() | rex field=message "(?<filter_error_msg>[^\{|\(|\@]+)" |stats count as current_hour by appName,filter_error_msg | appendcols [search (index=MYINDEX1 OR index= MYINDEX2) level=ERROR earliest=-169h@h latest=-168h@h | rex field=message "(?<filter_error_msg>[^\{|\(|\@]+)" | stats count as last_week_same_hour by appName,filter_error_msg] |fillnull value=0 | where ((current_hour > 1.2 * last_week_same_hour) AND current_hour > 25) My goals are 1. Detect newly popped up errors and alert 2. If error rate increased compare to last week I also saw anomalies command but not sure how to use it for this requirement. any suggestion on getting this splunk query. If I increase the timescale, the query completion is > 15mins which is very bad too. please suggest Thanks ... View more