Indextime


Feb. 23, 2022

The Trouble With _time: Better Splunk Search Scheduling with _index_earliest

You’ve lovingly crafted a new, bespoke Splunk search. How do you schedule it?