I have some Checkpoint logs (Firewall) that are generating an alert (Data hygiene - events in the future), I would like to know how I can confirm that the logs are arriving with the time in the future because they are coming with the time generated in the Checkpoint(Firewall)
I tried using some SPLs but I don't know if that's right.
| rest /services/data/indexes
| search title=checkpoint
| search totalEventCount > 0
| eval now=strftime(now(), "%Y-%m-%d")
| stats first(maxTime) as "Earliest Event Time" first(minTime) as "Latest Event Time" first(now) as "Current Date" first(currentDBSizeMB) as currentDBSizeMB by title
| rename title as "Index"
| sort - currentDBSizeMB
| eval "Index Size in GB"= round(currentDBSizeMB/1000,2)
| table Index "Earliest Event Time" "Latest Event Time" "Current Date" "Index Size in GB" updated
OR this SPL:
index=idx_checkpoint earliest=+5m latest=+10y
| eval criationtimelog=strftime(creation_time,"%Y-%m-%d %H:%M:%S")
| eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")
| table host _time indextime criationtimelog