Splunk Search

How do I create a new field time?

MagicCerbero
New Member

I have an alert table with certain values:
Time (alert occurrence) | Alert Name | Severity....


Would it be possible to create a time entry the first time an alert is accessed?


This would help me to create a first response SLA.

Time Alert Name Severity First reponse SLA
03/16/2022 05:20 PM Failed Login Medium 03/16/2022 05:25 PM 00:05
03/16/2022 05:30 PM Acces invalid High    
Labels (4)
Tags (2)
0 Karma

MagicCerbero
New Member

MagicCerbero_1-1647448920169.png

Correct is a question, is it possible to detect the exact date when the alert results are first accessed for review?

I don't know if it is possible for Splunk to collect that value in a field when doing that action.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How do you detect the first time an alert is accessed? Or is that your question? What do you mean by "accessed"?

0 Karma

MagicCerbero
New Member

Correct is a question, is it possible to detect the exact date when the alert results are first accessed for review?

I don't know if it is possible for Splunk to collect that value in a field when doing that action.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...