The logic below populates all the alerts to the test_alert_track lookup and display the alerts which are created within one day. |rest splunk_server=local /servicesNS/-/search/saved/searches | search alert.track=1 | eval updated = strptime(updated,"%Y-%m-%dT%H:%M:%S") | stats max(updated) as lastTime min(updated) as firsTime values(author) as author values(alert.track) as alert.track by title | inputlookup append=t test_alert_track.csv | stats min(firsTime) as firsTime max(lastTime) as lastTime values(author) as author values(alert.track) as alert.track by title | outputlookup test_alert_track.csv | search author!=nobody | where now()-firsTime < 86400 ... View more