https://community.splunk.com/t5/Alerting/APIs-inactive-for-more-than-one-week/m-p/615234#M14322 <P>Finding something that is not there is not Splunk's strong suit.&nbsp; See this blog entry for a good write-up on it.<BR /><BR /><A href="https://www.duanewaddle.com/proving-a-negative/" target="_blank">https://www.duanewaddle.com/proving-a-negative/</A></P><P>If you have a list of all APIs then you'll only need to search back 8 days to find the inactive ones.&nbsp; The link above will explain how.</P> Thu, 29 Sep 2022 15:20:45 GMT richgalloway 2022-09-29T15:20:45Z https://community.splunk.com/t5/Alerting/APIs-inactive-for-more-than-one-week/m-p/615230#M14321 <P>Hi,&nbsp;</P> <P>I have an index that return some logs with fields like _time, api names. I would like to display in dashboard or report or alert that which API has been inactive for more than one week. What I do right now is that find the most recent time with function latest(_time) and compare this with now, using relative_time. It works but the time range is all time and it takes some seconds to do so. I am worried that as the time goes it would take too long to get result.&nbsp; Is there some better way to achieve that?&nbsp;</P> Thu, 29 Sep 2022 15:17:13 GMT https://community.splunk.com/t5/Alerting/APIs-inactive-for-more-than-one-week/m-p/615230#M14321 xwang333 2022-09-29T15:17:13Z https://community.splunk.com/t5/Alerting/APIs-inactive-for-more-than-one-week/m-p/615234#M14322 <P>Finding something that is not there is not Splunk's strong suit.&nbsp; See this blog entry for a good write-up on it.<BR /><BR /><A href="https://www.duanewaddle.com/proving-a-negative/" target="_blank">https://www.duanewaddle.com/proving-a-negative/</A></P><P>If you have a list of all APIs then you'll only need to search back 8 days to find the inactive ones.&nbsp; The link above will explain how.</P> Thu, 29 Sep 2022 15:20:45 GMT https://community.splunk.com/t5/Alerting/APIs-inactive-for-more-than-one-week/m-p/615234#M14322 richgalloway 2022-09-29T15:20:45Z