Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Creation Date of a Scheduled Search Copy


				index=_audit sourcetype=audittrail savedsearch_name=<insert search title> earliest=-365d | stats earliest(_time) as created | eval created=strftime(created,"%m/%d/%Y %H:%M:%S")

0 comments

[0]