Hello, I am very new to Splunk but trying to figure a few things out. I have been tasked with building a search so that I can monitor who accesses a directory on a Linux box. I am very unsure how to start this process. I don't have the path that I would like to monitor either but I have been asked to get something basic so that I can just put in the path to the directory when they set it up.    I realize this is not a lot of information but I would appreciate any help!   Thank you in advance! ... View more

I am looking to identify specific assets that have not been logged into in over a set time. I am fairly new to all of this and trying to learn in a more hands on way. I was wondering what would be the best way to accomplish this? I was thinking something like this but I don't think this is right: EventCode=4624 AND [|inputlookup append=t Computers.csv] NOT [inputlookup append=t Dont_search.csv] | dedup host | table _time,host,user | sort host Computers.csv - Specific computers that I want to track. Dont_search.csv - Accounts that I DO NOT want to track.  I am hoping to show all computers on my list regardless of whether they were logged in too. Any help would be greatly appreciated!!! ... View more