First Time Seen Running Windows Service
This search looks for the first and last time a Windows service is seen running in your environment. This table is then cached.
This content is not mapped to any local saved search. Add mapping
First Time Seen Running Windows Service Help
While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows system event logs in order for this search to execute successfully. You should run the baseline search
Open in Search