Splunk Search

How would I write the following if statements in Splunk?

troy44112
Explorer

How would I write the following statements in Splunk?
Variables are start_access and last_access

Statement
If 20 days have passed from the start_access AND there was no last_access since the last start_access, then the result is not active.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats latest(_time) as _time latest(access) as access
| where access="start_access" AND now()-_time > (20*24*60*60)
| eval result="not active"
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...