Solved: Saved search creation date

luislcruz · ‎07-27-2021

I'm searching about how can I get the saved searches creation date, but I didn't see it in any documentation.

Is it possible to use rest command to see this info or any other command? I got only the updated field, but it's not what I need.

richgalloway · ‎07-27-2021

AFAIK, KO creation dates are not saved anywhere, with the exception of file-based KOs (lookup files, dashboards, datamodels) where the operating system tracks the file creation date. Splunk does not access the OS file creation date.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎07-27-2021

AFAIK, KO creation dates are not saved anywhere, with the exception of file-based KOs (lookup files, dashboards, datamodels) where the operating system tracks the file creation date. Splunk does not access the OS file creation date.

---
If this reply helps you, Karma would be appreciated.

Saved search creation date

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

Splunk Answers Content Calendar, July Edition I

Are you a member of the Splunk Community?

Saved search creation date

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

Splunk Answers Content Calendar, July Edition I