Here's my command: | metadata type=hosts index= | sort lastTime | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time Now, I know that this might not be the most efficient command in the world, but I'm sort of a n00b. What I am now attempting to do from this is take resulting hosts who's "Latest_Time" > 24 hrs and alert on those hosts. If you're wondering why I sorted twice, for some reason the way I built the command, it wasn't sorting properly, when I sorted again, it worked. Any help on this matter would be greatly appreciated. ... View more

I am pretty sure this involves lookups but here is what I am attempting. I have a list of users in a CSV (users.csv) but it's about 70 names. I want to search a certain sourcetype for these names without having to finger bang them in one at a time. How do I do this? I feel like this is covered somewhere and I have RTFM already. Any assistance with an answer or at least a nudge in the right direction would be greatly appreciated! ... View more

I've been tasked with searching for authentication irregularities and I am fairly new to splunk. Authentication irregularities is fairly broad and so I am wondering if the splunk community has any suggestions! Thanks in advance. And if you were wondering, yes I have read the manual already. ... View more