Splunk Search

How do I create a new field time?

MagicCerbero
New Member

I have an alert table with certain values:
Time (alert occurrence) | Alert Name | Severity....


Would it be possible to create a time entry the first time an alert is accessed?


This would help me to create a first response SLA.

Time Alert Name Severity First reponse SLA
03/16/2022 05:20 PM Failed Login Medium 03/16/2022 05:25 PM 00:05
03/16/2022 05:30 PM Acces invalid High    
Labels (4)
Tags (2)
0 Karma

MagicCerbero
New Member

MagicCerbero_1-1647448920169.png

Correct is a question, is it possible to detect the exact date when the alert results are first accessed for review?

I don't know if it is possible for Splunk to collect that value in a field when doing that action.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How do you detect the first time an alert is accessed? Or is that your question? What do you mean by "accessed"?

0 Karma

MagicCerbero
New Member

Correct is a question, is it possible to detect the exact date when the alert results are first accessed for review?

I don't know if it is possible for Splunk to collect that value in a field when doing that action.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...