Splunk Search

How do I create a new field time?

MagicCerbero
New Member

I have an alert table with certain values:
Time (alert occurrence) | Alert Name | Severity....


Would it be possible to create a time entry the first time an alert is accessed?


This would help me to create a first response SLA.

Time Alert Name Severity First reponse SLA
03/16/2022 05:20 PM Failed Login Medium 03/16/2022 05:25 PM 00:05
03/16/2022 05:30 PM Acces invalid High    
Labels (4)
Tags (2)
0 Karma

MagicCerbero
New Member

MagicCerbero_1-1647448920169.png

Correct is a question, is it possible to detect the exact date when the alert results are first accessed for review?

I don't know if it is possible for Splunk to collect that value in a field when doing that action.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How do you detect the first time an alert is accessed? Or is that your question? What do you mean by "accessed"?

0 Karma

MagicCerbero
New Member

Correct is a question, is it possible to detect the exact date when the alert results are first accessed for review?

I don't know if it is possible for Splunk to collect that value in a field when doing that action.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...