topic Re: Time_format_change_procedure in Splunk Dev

Time_format_change_procedure

abid91 — Thu, 28 Sep 2017 09:39:48 GMT

Hi Guys,
I am trying to create a use-case as " date when any single user was created in AD" it's done but I need to change time format to readable format, right now it coming like this "20170905133223.0Z" how can I convert it to as " 05-September-2017" I tried with eval command as follows but no effect in results.

Re: Time_format_change_procedure

gcusello — Thu, 28 Sep 2017 09:51:25 GMT

HI abid91,
try something like this

| ldapsearch domain=default search="(objectClass=user)" 
| eval whenCreated=strftime(strptime(whenCreated, "%Y %m %d %H:%M:%S"), "%d/%m/%Y")
| table displayName,whenCreated

Check the original time format of whenCreated
Bye.
Giuseppe

Re: Time_format_change_procedure

inventsekar — Thu, 28 Sep 2017 09:52:01 GMT

Please check -
search:| ldapsearch domain=default search="(objectClass=user)" |eval epochtime=strptime(whenCreated, "%Y%m%d%H%M%S.%1N%Z") | eval desired_time=strftime(epochtime, "%d/%m/%Y") | table displayName whenCreated desired_time

Re: Time_format_change_procedure

abid91 — Thu, 28 Sep 2017 10:07:04 GMT

its showing blank values in whenCreated filed.

Re: Time_format_change_procedure

abid91 — Thu, 28 Sep 2017 10:15:24 GMT

Yes! it's working thank you