Hello,
Every day Splunk forwarders collect different types of system events (warnings,errors,informations, criticals) from machines. These events are constantly changing: a new one appears, others disappear and some stay.
What i want to do is count the number of missing/new events for every day and list them in a table by their ID and type.
Thanks in advance
Exaclty. in comparison with yesterday i want a table with the missing and new events
So when you want to compare, do you want to compare against yesterday (e.g. list all events that came yesterday but not today etc)?