{"id":40880,"date":"2021-08-05T17:52:39","date_gmt":"2021-08-05T17:52:39","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=40880"},"modified":"2021-08-05T17:52:39","modified_gmt":"2021-08-05T17:52:39","slug":"answer-by-warren-for-find-all-newer-events-logged-by-application-after-a-certain-date-in-splunk","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=40880","title":{"rendered":"Answer by warren for Find all newer events logged by application after a certain date in splunk"},"content":{"rendered":"<p>If these are internal applications, I presume this means you <em>also<\/em> have custom <code>props.conf<\/code> and <code>transforms.conf<\/code> for the logs?<\/p>\n<p>If you add new field extractions because of newer logging contents, then you will only <em>see<\/em> those newer fields in the newer data &#8211; because they won&#8217;t exist in the older data<\/p>\n<p>from User warren &#8211; Stack Overflow https:\/\/stackoverflow.com\/questions\/68663778\/find-all-newer-events-logged-by-application-after-a-certain-date-in-splunk\/68671302#68671302<br \/>\nvia <a href=\"https:\/\/ifttt.com\/?ref=da&#038;site=wordpress\">IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>If these are internal applications, I presume this means you also have custom props.conf and transforms.conf for the logs? If you add new field extractions because of newer logging contents, then you will only see those newer fields in the newer data &#8211; because they won&#8217;t exist in the older data from User warren &#8211; &hellip;<br \/><a href=\"https:\/\/merikebi.warrenmyers.com\/?p=40880\" class=\"more-link pen_button pen_element_default pen_icon_arrow_double\">Continue reading <span class=\"screen-reader-text\">Answer by warren for Find all newer events logged by application after a certain date in splunk<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-40880","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/40880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=40880"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/40880\/revisions"}],"predecessor-version":[{"id":40881,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/40880\/revisions\/40881"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40880"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=40880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}