I want to monitor if user run new search in our environment or created new alert
i tried to use this query :
|rest /services/saved/searches | search action.email.to=* OR action.email.to=* | where disabled=0 | table title , search , updated
the problem is that there is no time field in order to compare the 'updated' value with time to know if there is something new.
is there any other way to check new entries ?
I think that you should use REST Endpoint
| rest /servicesNS/-/-/saved/searches
to get all users saved searches from all apps. With your original you didn't get those.
I think that you get only alerts/reports etc. which are stored into savedsearches.conf not those which users are currently running as add hoc. But best to check it unless someone can confirm this.
To check if there are any new savedsearches which has modified you must generate lookup where you stored those modified times and then check if that differs now.
Tom West does a good presentation on Dashboarding Wowzas at BSides (BSides Splunk Conference) and other places where he presents version control for dashboards. This could easily be modified to deal with searches.