Need Query which we can track to find which Log sources are Commissioning and Decommissioning in SPlunk and generate report.
How do you determine whether a log source is commissioning or decommissioning?
Yes the ask is , Is there a way in Splunk we can create query which we can find out log sources are Commissioning and Decommissioning
What do you mean by commissioning and decommissioning and what evidence does splunk have available to it for either or both e.g. do you just need to know when a source is first written to and last written to, or is there something else that would tell you that the source has been commissioned or decommissioned?
Is there something else that would tell you that the source has been commissioned or decommissioned?
yes correct is there a way?
That is for you to decide - would the first time an event appears in a log signify that it has been commissioned or does the event have to be of a particular type? Would the last event being over a week old signify that it has been decommissioned or would a day or hour be sufficient, or would there be some sort of termination event in the log? This is your data, you need to tell splunk how to interpret it.