https://community.splunk.com/t5/Splunk-Search/when-the-machine-was-build-or-when-the-machine-started/m-p/502173#M140115 <P>Hi @brpsingara</P> <PRE><CODE>| metadata type=hosts index=_internal | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c") </CODE></PRE> <P>This sample search is basically just taken on the official docs Search Reference.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Metadata">https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Metadata</A></P> <P>Hope it helps!</P> Fri, 22 May 2020 14:37:34 GMT lloydknight 2020-05-22T14:37:34Z https://community.splunk.com/t5/Splunk-Search/when-the-machine-was-build-or-when-the-machine-started/m-p/502172#M140114 <P>I got regular question from auditors. <BR />we have 100 machines,<BR />Machine1<BR />Machine2<BR />..<BR />..<BR />Machine100</P> <P>and auditor asked to run/search one year old data for the 'machine34'. <BR />I did search by using <CODE>* host=machine34</CODE> and manually i selected 2019 March<BR />If data is there i am fine, but unfortunately data is not showing. Because the machine34 was build 2 months back. It took 2 hours to find the solutions for this. So...,</P> <P>My question is possible to see build date or 1st contact date of machine by using splunk.</P> <P>I am using below code to view the all machines</P> <PRE><CODE>| metadata type=hosts index=* | stats count by host </CODE></PRE> <P>I am looking for another field, that is build date or contacting to splunk date.</P> <P>Will it be possible ?</P> <P>Thanks in advance.</P> Fri, 05 Jun 2020 22:27:09 GMT https://community.splunk.com/t5/Splunk-Search/when-the-machine-was-build-or-when-the-machine-started/m-p/502172#M140114 brpsingara 2020-06-05T22:27:09Z https://community.splunk.com/t5/Splunk-Search/when-the-machine-was-build-or-when-the-machine-started/m-p/502173#M140115 <P>Hi @brpsingara</P> <PRE><CODE>| metadata type=hosts index=_internal | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c") </CODE></PRE> <P>This sample search is basically just taken on the official docs Search Reference.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Metadata">https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Metadata</A></P> <P>Hope it helps!</P> Fri, 22 May 2020 14:37:34 GMT https://community.splunk.com/t5/Splunk-Search/when-the-machine-was-build-or-when-the-machine-started/m-p/502173#M140115 lloydknight 2020-05-22T14:37:34Z https://community.splunk.com/t5/Splunk-Search/when-the-machine-was-build-or-when-the-machine-started/m-p/502174#M140116 <P>Thanks lloydknight</P> Fri, 22 May 2020 15:44:24 GMT https://community.splunk.com/t5/Splunk-Search/when-the-machine-was-build-or-when-the-machine-started/m-p/502174#M140116 brpsingara 2020-05-22T15:44:24Z