filter data

numeroinconnu12 — Mon, 20 Jul 2020 20:22:07 GMT

Hello everyone, I have a splunk query that returns the connection ranges with the start and end of the connection. Below is an example. user DateMin DateMax 1234 2020-07-14 04:54:21 2020-07-14 06:02:54 I would just like to display connections that last at least 6 minutes. Thanks.

Re: filter data

anilchaithu — Mon, 20 Jul 2020 20:44:03 GMT

@numeroinconnu12

follow these steps

convert the timestamps into epoch, eval DateMin=strptime(DateMin, "%Y-%m-%d %H:%M:%S")
difference between the two epoch times will be in seconds, eval Diff=(DateMax-DateMin)
convert the difference to min, eval Diff=round(Diff/60,2)
add a filter using where command, where Diff > 6

adding all the above steps together

eval DateMin=strptime(DateMin, "%Y-%m-%d %H:%M:%S"), DateMax=strptime(DateMax, "%Y-%m-%d %H:%M:%S") | eval Diff=round((DateMax-DateMin)/60,2) | where Diff > 6

you can merge them to a single eval. But I though this will give you good clarity.

Hope this helps

topic filter data in Splunk Enterprise Security

filter data

Re: filter data