Splunk Enterprise Security

How to create a search that shows if the last seen date was greater than 7 days

New Member

I've tried a few different things but they don't appear to be working. I have a log that gives out the last day and time a particular software was seen on a machine (host properties last seen).

I want to create a search that shows if the last seen date was greater than 7 days.

Any thoughts on the best way to do this?

Thanks.

0 Karma
1 Solution