https://community.splunk.com/t5/Splunk-Search/How-do-I-create-a-new-field-time/m-p/589370#M205232 <P>I have an alert table with certain values:<BR />Time (alert occurrence) | Alert Name | Severity....</P> <P><BR />Would it be possible to create a time entry the first time an alert is accessed?</P> <P><BR />This would help me to create a first response SLA.</P> <TABLE border="1" width="100%"> <TBODY> <TR> <TD width="25%">Time</TD> <TD width="25%">Alert Name</TD> <TD width="25%">Severity</TD> <TD width="12.5%">First reponse</TD> <TD width="12.5%">SLA</TD> </TR> <TR> <TD width="25%">03/16/2022 05:20 PM</TD> <TD width="25%">Failed Login</TD> <TD width="25%">Medium</TD> <TD width="12.5%">03/16/2022 05:25 PM</TD> <TD width="12.5%">00:05</TD> </TR> <TR> <TD width="25%">03/16/2022 05:30 PM</TD> <TD width="25%">Acces invalid</TD> <TD width="25%">High</TD> <TD width="12.5%">&nbsp;</TD> <TD width="12.5%">&nbsp;</TD> </TR> </TBODY> </TABLE> Wed, 16 Mar 2022 16:45:24 GMT MagicCerbero 2022-03-16T16:45:24Z https://community.splunk.com/t5/Splunk-Search/How-do-I-create-a-new-field-time/m-p/589370#M205232 <P>I have an alert table with certain values:<BR />Time (alert occurrence) | Alert Name | Severity....</P> <P><BR />Would it be possible to create a time entry the first time an alert is accessed?</P> <P><BR />This would help me to create a first response SLA.</P> <TABLE border="1" width="100%"> <TBODY> <TR> <TD width="25%">Time</TD> <TD width="25%">Alert Name</TD> <TD width="25%">Severity</TD> <TD width="12.5%">First reponse</TD> <TD width="12.5%">SLA</TD> </TR> <TR> <TD width="25%">03/16/2022 05:20 PM</TD> <TD width="25%">Failed Login</TD> <TD width="25%">Medium</TD> <TD width="12.5%">03/16/2022 05:25 PM</TD> <TD width="12.5%">00:05</TD> </TR> <TR> <TD width="25%">03/16/2022 05:30 PM</TD> <TD width="25%">Acces invalid</TD> <TD width="25%">High</TD> <TD width="12.5%">&nbsp;</TD> <TD width="12.5%">&nbsp;</TD> </TR> </TBODY> </TABLE> Wed, 16 Mar 2022 16:45:24 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-create-a-new-field-time/m-p/589370#M205232 MagicCerbero 2022-03-16T16:45:24Z https://community.splunk.com/t5/Splunk-Search/How-do-I-create-a-new-field-time/m-p/589372#M205234 <P>How do you detect&nbsp;<SPAN>the first time an alert is accessed? Or is that your question? What do you mean by "accessed"?</SPAN></P> Wed, 16 Mar 2022 16:35:27 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-create-a-new-field-time/m-p/589372#M205234 ITWhisperer 2022-03-16T16:35:27Z https://community.splunk.com/t5/Splunk-Search/How-do-I-create-a-new-field-time/m-p/589376#M205236 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="MagicCerbero_1-1647448920169.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/18549iF71FAB0DA216A5AC/image-size/medium?v=v2&amp;px=400" role="button" title="MagicCerbero_1-1647448920169.png" alt="MagicCerbero_1-1647448920169.png" /></span></P><P>Correct is a question, is it possible to detect the exact date when the alert results are first accessed for review?</P><P>I don't know if it is possible for Splunk to collect that value in a field when doing that action.</P> Wed, 16 Mar 2022 16:44:42 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-create-a-new-field-time/m-p/589376#M205236 MagicCerbero 2022-03-16T16:44:42Z https://community.splunk.com/t5/Splunk-Search/How-do-I-create-a-new-field-time/m-p/589377#M205237 <P>Correct is a question, is it possible to detect the exact date when the alert results are first accessed for review?</P><P>I don't know if it is possible for Splunk to collect that value in a field when doing that action.</P> Wed, 16 Mar 2022 16:46:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-create-a-new-field-time/m-p/589377#M205237 MagicCerbero 2022-03-16T16:46:00Z