Solved: Saved search creation date

luislcruz · ‎07-27-2021

I'm searching about how can I get the saved searches creation date, but I didn't see it in any documentation.

Is it possible to use rest command to see this info or any other command? I got only the updated field, but it's not what I need.

richgalloway · ‎07-27-2021

AFAIK, KO creation dates are not saved anywhere, with the exception of file-based KOs (lookup files, dashboards, datamodels) where the operating system tracks the file creation date. Splunk does not access the OS file creation date.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎07-27-2021

AFAIK, KO creation dates are not saved anywhere, with the exception of file-based KOs (lookup files, dashboards, datamodels) where the operating system tracks the file creation date. Splunk does not access the OS file creation date.

---
If this reply helps you, Karma would be appreciated.

Saved search creation date

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

Data Persistence in the OpenTelemetry Collector

Thanks for the Memories! Splunk University, .conf25, and our Community

Are you a member of the Splunk Community?

Saved search creation date

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

Data Persistence in the OpenTelemetry Collector

Thanks for the Memories! Splunk University, .conf25, and our Community