Splunk Enterprise Security

How to create a search that shows if the last seen date was greater than 7 days

crisp023
New Member

I've tried a few different things but they don't appear to be working. I have a log that gives out the last day and time a particular software was seen on a machine (host properties last seen).

I want to create a search that shows if the last seen date was greater than 7 days.

Any thoughts on the best way to do this?

Thanks.

0 Karma
1 Solution
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...