To find New error in server logs that was not present in logs in the past one week

Question

I am looking to trigger an alert in splunk if a new error is there in server logs. New error is an error/s that was not present in server logs in the past one week. I have index for logs index=Serverlogs1.

Please help!

Answer 1

Finding something that has not been seen in some time requires searching all of the data over that period so be prepared for slow performance. It will help if you can be specific about the criteria for a "new" event. Start with this search. Replace _raw with specific fields, if possible.

index=serverlogs1 earliest=-1w
| stats count by _raw
| where count = 1