Deployment Architecture
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

Which Field Should I look at to find the task created in Unix servers

kaskirana01
New Member

Hi, I have raw unix logs and I have to create an use case to find the schedules task created by the users. I f I search for the keyword "cron" then it's listing out all the schedules jobs including it's run time etc. I need to get the events which states the 1st time creation of task. What is the logic for this?

Tags (2)
0 Karma

lycollicott
Motivator

| search .....whatever..your..search..is...... | tail 1

That will give you the oldest result of your search.

0 Karma

kaskirana01
New Member

Thanks,
But is there any particular field which should look into?
If I do as you said, that will not give me clear output

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!