Query to find devices are Commissioning and Decommissioning

[sahildb]

Need Query which we can track to find which Log sources are Commissioning and Decommissioning in SPlunk and generate report.

[ITWhisperer]

How do you determine whether a log source is commissioning or decommissioning?

[sahildb]

Yes  the ask is , Is there a way in Splunk we can create query which we can find out log sources are Commissioning and Decommissioning

[ITWhisperer]

What do you mean by commissioning and decommissioning and what evidence does splunk have available to it for either or both e.g. do you just need to know when a source is first written to and last written to, or is there something else that would tell you that the source has been commissioned or decommissioned?

[sahildb]

Is there something else that would tell you that the source has been commissioned or decommissioned?

yes correct is there a way?

[ITWhisperer]

That is for you to decide - would the first time an event appears in a log signify that it has been commissioned or does the event have to be of a particular type? Would the last event being over a week old signify that it has been decommissioned or would a day or hour be sufficient, or would there be some sort of termination event in the log? This is your data, you need to tell splunk how to interpret it.