What I am trying to do is currently search for Computers that were last seen 10 days or more ago. Currently right now I have the following search syntax:
ComputerName=* AgentVersion=* | dedup ComputerName| table timestamp ComputerName, AgentVersion.
Do I need an eval and then last seen time? If so how would I do that?
Thank you,
Jack McAloon
↧