topic Re: How do I filter my search to only return search applications that have not been accessed by anyone in the last 60 days? in Splunk Search

How do I filter my search to only return search applications that have not been accessed by anyone in the last 60 days?

taraksinha — Thu, 18 Feb 2016 09:24:49 GMT

Hi Team,

I ran the search below to find search Applications which are not accessed in last 2 months by anyone, but it's instead showing results from now (today's date) to the past 60 days. I only need to output applications that have never been accessed by anyone within the last 60 days.

Search:

index=_internal source=*access.log earliest=-60d  /app/ | rex "\/app\/(?\w+)\/(?\w+)\"" | search AppName=search AND ViewName=* | stats max(_time) as LastAccessed by AppName, ViewName | eval age=now()-LastAccessed | where age>20 |eval Date=strftime(LastAccessed,"%d-%m-%Y %H:%M:%S")

Re: How do I filter my search to only return search applications that have not been accessed by anyone in the last 60 days?

richgalloway — Thu, 18 Feb 2016 13:02:50 GMT

The where clause of this search finds apps accessed at least 20 seconds ago, which is probably not what you want. Changing 20 to 5184000 will return those accessed at least 60 days ago.

That said, this search still only finds apps that were accessed 2 months ago. It does not identify those that have not been accessed since then. To do that, you will need a list of all apps from which you remove those which have been accessed in the last 60 days. You can get a list of all apps installed on your system using rest /services/apps/local.

Re: How do I filter my search to only return search applications that have not been accessed by anyone in the last 60 days?

taraksinha — Fri, 19 Feb 2016 07:31:56 GMT

I tried to change age 20 to 5184000, but not showing any result, Can be add owner and user filed in this query?

Re: How do I filter my search to only return search applications that have not been accessed by anyone in the last 60 days?

richgalloway — Fri, 19 Feb 2016 13:32:02 GMT

Just changing 20 to 5184000 is not enough. That makes the where clause match earliest and return no results. Even if earliest is changed, the search is still returning apps that were accessed at least 60 days ago rather than those not accessed in the last 60 days.

Re: How do I filter my search to only return search applications that have not been accessed by anyone in the last 60 days?

taraksinha — Fri, 19 Feb 2016 14:17:19 GMT

will you give me similar query along with user and owner field?

Re: How do I filter my search to only return search applications that have not been accessed by anyone in the last 60 days?

taraksinha — Tue, 29 Sep 2020 08:52:22 GMT

I need output for user who often or never accessed the App_Name "search" more than 60 days with table such as user,Viewname,title,App_name,owner,Date,Last accessed.

Re: How do I filter my search to only return search applications that have not been accessed by anyone in the last 60 days?

richgalloway — Fri, 19 Feb 2016 14:49:24 GMT

I'm not sure which query you mean. I see a user field in access.log, but not an owner field. It could be part of another field.
The REST query has an eai:acl.owner field, but no user field since it's a raw app list.

Re: How do I filter my search to only return search applications that have not been accessed by anyone in the last 60 days?

taraksinha — Sun, 21 Feb 2016 09:21:04 GMT

I mean this below query, is it any command to add user and owner field ?

index=_internal source=*access.log earliest=-60d  /app/ | rex "\/app\/(?\w+)\/(?\w+)\"" | search AppName=search AND ViewName=* | stats max(_time) as LastAccessed by AppName, ViewName | eval age=now()-LastAccessed | where age>20 |eval Date=strftime(LastAccessed,"%d-%m-%Y %H:%M:%S")

Re: How do I filter my search to only return search applications that have not been accessed by anyone in the last 60 days?

MuS — Sun, 21 Feb 2016 09:26:49 GMT

Just a reminder: index=_internal has a default retention time of 30 days - so you will not be able to find anything for days 31-60.

Re: How do I filter my search to only return search applications that have not been accessed by anyone in the last 60 days?

taraksinha — Sun, 21 Feb 2016 13:30:09 GMT

So any idea how can i approach this to get the result for 31-60 days?