Hello Splunkers,
I was wondering if there is a way to get the creation date of a correlation search.
If so, what is it, because I found nothing anywhere.
Thanks in advance,
Best regards!
If you're running Splunk 9+ then the _configtracker index should have it. Look for adds to the savedsearches.conf file.
Can we get the cs created date in Splunk v8
It's not available before v9.
If you're running Splunk 9+ then the _configtracker index should have it. Look for adds to the savedsearches.conf file.
We are still not in 9+, but it is scheduled.
Thanks for your answer I think I got it.