I don't think this is exactly it but it may lead you to the right path   | rest /services/datamodel/model |search eai:appName=search | table updated   The updated field shows when the model was last updated.  ... View more

Nice! Exactly what I was looking for! I did know to replace with the index. Opsec was just "Operations Security" to not reveal what we are running. 😀 ... View more

Understand what security monitoring means and learn more about it and Remember, the best way to learn is by doing. Start with some basic use cases and gradually progress to more advanced ones. You can also join online communities and forums to connect with other Splunk users and ask questions. https://www.splunk.com/en_us/blog/security/introducing-splunk-security-use-cases.html https://lantern.splunk.com/Security/Getting_Started/Identifying_Splunk_Enterprise_Security_use_cases_and_data_sources https://www.splunk.com/en_us/resources/videos/splunk-enterprise-security-use-case-library.html   ... View more

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/Alert/AlertTriggerConditions   Per the documentation, you can't control the ability to trigger via permissions.     ... View more