APIs inactive for more than one week?

[xwang333]

Hi, 

I have an index that return some logs with fields like _time, api names. I would like to display in dashboard or report or alert that which API has been inactive for more than one week. What I do right now is that find the most recent time with function latest(_time) and compare this with now, using relative_time. It works but the time range is all time and it takes some seconds to do so. I am worried that as the time goes it would take too long to get result.  Is there some better way to achieve that? 

[richgalloway · Accepted solution]

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

If you have a list of all APIs then you'll only need to search back 8 days to find the inactive ones.  The link above will explain how.