For my instance, though there was no official "install date" recorded, you can use the first instances of splunkd logs to be able to estimate when a machine was installed with a splunk agent, I used the following: | tstats min(_time) as firsttime, count where index=_internal AND source=*splunkd* by host | eval nowtime=now()-604800 | where firsttime>nowtime Which essentially says go back to and find the earliest instance of a log, if it is within the last week then it is an assumed new machine and we will record it, otherwise remove it from the list. Is this method perfect? no but it will get you a ballpark of machines onboarded in the past week. Best solution would probably be to create a saved search to record every new instance of a machine in the past 24 hours and append it to a lookup. ... View more