https://community.splunk.com/t5/Splunk-Search/Create-Saved-Search-For-A-Files-Time-Stamp/m-p/53463#M179712 <P>You can look at <CODE>_indextime</CODE> to see when the file was forwarded but the only way to get the timestamp of the file is if it is encoded in the filename or in data inside the file. But you could do something like this</P> <PRE><CODE>index=myIndex (source=source1 OR source=source2) | stats latest(_time) AS latestTime BY source | eval waitingSecs = now() - latestTime | where watingSecs &gt; 1200 </CODE></PRE> <P>Then save this search as an alert and run it every X minutes for the last hour (-1h) and have it email you whenever numevents&gt;0.</P> Tue, 30 Jun 2015 04:37:29 GMT woodcock 2015-06-30T04:37:29Z https://community.splunk.com/t5/Splunk-Search/Create-Saved-Search-For-A-Files-Time-Stamp/m-p/53462#M179711 <P>Splunk univerisal forwarder is installed on a linux server. This server is indexing a number of files. I need to create a Saved Search to search on the time stamp of two of the files. If the time stamp of the files is 20 minutes old then it tells me a process is not running on the Linux server.</P> <P>Would anyone know how to create such a saved search.</P> Wed, 18 Jan 2012 14:56:00 GMT https://community.splunk.com/t5/Splunk-Search/Create-Saved-Search-For-A-Files-Time-Stamp/m-p/53462#M179711 itsquinj 2012-01-18T14:56:00Z https://community.splunk.com/t5/Splunk-Search/Create-Saved-Search-For-A-Files-Time-Stamp/m-p/53463#M179712 <P>You can look at <CODE>_indextime</CODE> to see when the file was forwarded but the only way to get the timestamp of the file is if it is encoded in the filename or in data inside the file. But you could do something like this</P> <PRE><CODE>index=myIndex (source=source1 OR source=source2) | stats latest(_time) AS latestTime BY source | eval waitingSecs = now() - latestTime | where watingSecs &gt; 1200 </CODE></PRE> <P>Then save this search as an alert and run it every X minutes for the last hour (-1h) and have it email you whenever numevents&gt;0.</P> Tue, 30 Jun 2015 04:37:29 GMT https://community.splunk.com/t5/Splunk-Search/Create-Saved-Search-For-A-Files-Time-Stamp/m-p/53463#M179712 woodcock 2015-06-30T04:37:29Z