topic Re: Convert AD LDAP Timestamp to Epoch or other readable date in Getting Data In

Convert AD LDAP Timestamp to Epoch or other readable date

dwithers — Wed, 16 Apr 2014 12:17:37 GMT

Using ldapsearch queries in the splunk for windows ifnrastructure app, I am trying to convert the following fields timestamp which is the integer8 windows NT timestamp to epoch or other readable time after my query runs. The timestamp is the number of 100-nanoseconds intervals (1 nanosecond = one billionth of a second) since Jan 1, 1601 UTC

Anyone have any experience with this? Would be much appreciated!

field = msDS-LastSuccessfulInteractiveLogonTime
timestamp returned = 129878945338632316

Re: Convert AD LDAP Timestamp to Epoch or other readable date

MuS — Wed, 16 Apr 2014 12:34:40 GMT

Hi dwithers,

take this run everywhere example and adapt it to your needs:

index=_internal | head 1 | eval AD_time="129878945338632316" 
| eval myTime=AD_time/1000000000 
| eval myNiceTime=strftime(myTime, "%F %H:%M:%S.%3Q") 
| table myNiceTime

the first line is only to setup the AD like time field, the second eval will 'convert' it into epoch time and the last eval will create a nice human readable time stamp out of it.

cheers, MuS

Re: Convert AD LDAP Timestamp to Epoch or other readable date

MuS — Wed, 16 Apr 2014 12:52:57 GMT

small update: are you sure these are nano seconds? Looks like there is one number missing in your example....

Re: Convert AD LDAP Timestamp to Epoch or other readable date

dwithers — Wed, 16 Apr 2014 13:23:30 GMT

Actually, i just found it's 64bit in of the number of 100 nanoseconds since 1/1/1601

Re: Convert AD LDAP Timestamp to Epoch or other readable date

dwithers — Wed, 16 Apr 2014 13:37:48 GMT

he current LDAP time = (time()+11644473600)*10000000;
You can replace time() with any UNIX timestamp or strtotime("15 November 2012") is the math if ound around it

Re: Convert AD LDAP Timestamp to Epoch or other readable date

dwithers — Wed, 16 Apr 2014 13:42:33 GMT

eval myTime=AD_time/10000000 - 11644473600

got it. Thanks for your help!