index=_internal sourcetype=splunk_python action="handleCreate" | stats latest(_time) as _time by loginUsername indexName
0 comments