https://community.splunk.com/t5/Getting-Data-In/Google-Drive-Age-Monitoring/m-p/677179#M113235 <P><SPAN>Hi,</SPAN></P><P><SPAN>So I’m working on creating an alert in Splunk, but I’m having some issues with setting up the query. The goal of the alert is to trigger when a shared drive or folder in Google Drive has been shared externally for longer than a set period of time. I’ve seen some mentions of using the poolPeriod and fschange functions, but those seem to be better suited for system directories rather than Google Drive.</SPAN></P><P>&nbsp;</P><P><SPAN>Any advice on how to start setting up this query?</SPAN></P> Fri, 09 Feb 2024 22:58:10 GMT tonyngassi 2024-02-09T22:58:10Z https://community.splunk.com/t5/Getting-Data-In/Google-Drive-Age-Monitoring/m-p/677179#M113235 <P><SPAN>Hi,</SPAN></P><P><SPAN>So I’m working on creating an alert in Splunk, but I’m having some issues with setting up the query. The goal of the alert is to trigger when a shared drive or folder in Google Drive has been shared externally for longer than a set period of time. I’ve seen some mentions of using the poolPeriod and fschange functions, but those seem to be better suited for system directories rather than Google Drive.</SPAN></P><P>&nbsp;</P><P><SPAN>Any advice on how to start setting up this query?</SPAN></P> Fri, 09 Feb 2024 22:58:10 GMT https://community.splunk.com/t5/Getting-Data-In/Google-Drive-Age-Monitoring/m-p/677179#M113235 tonyngassi 2024-02-09T22:58:10Z