Splunk Enterprise Security

how to calculate time between events for the past month

sabinayousoubuv
New Member

Hello,

I have an index for a symantec produt, and I have to write a search to alert if any of the sourcetypes doesn't get any data in for a certain amount of time.

Calculating the time is a little tricky for me, since it has to ba searches this way:

Searching for the time differences between all events by sourcetypes for the last month, and make a summary of it.

The alert should apear everytime the index won't get data from a certain sourcetype for longer time than the result from the search above.

I would realy love to get some help,
thank you!

0 Karma

woodcock
Esteemed Legend
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...