topic Re: Change Time Format of ldapsearch attribute AccountExpired in Splunk Enterprise Security

Change Time Format of ldapsearch attribute AccountExpired

Sasquatchatmars — Mon, 05 Oct 2020 11:52:07 GMT

Hi all,

I have been trying to make a search where i can monitor the expired user accounts. So far i have this

| ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="*" | table accountExpires sAMAccountName

My problem is the time output. For example, in the AD the time is set to let's say 10/5/2020 12:00:00 AM and Splunk gives 2020-10-04T22:00:00Z as output. I know there Splunk gives it in UTC but we are in GMT+2. Is there a way, without modifying any settings to have the same output as in the AD?

Thank you very much

Sasquatchatmars

Re: Change Time Format of ldapsearch attribute AccountExpired

richgalloway — Mon, 05 Oct 2020 13:00:37 GMT

You can change the format using strptime() and strftime() like this.

| eval accountExpires = strftime(strptime(accountExpires, "$Y-%m-%dYT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

Splunk lacks a way to convert time zones. You can add 2 hours to the converted time, but may still display as UTC, which would then be incorrect. See https://ideas.splunk.com/ideas/E-I-27

Re: Change Time Format of ldapsearch attribute AccountExpired

Sasquatchatmars — Fri, 09 Oct 2020 09:03:07 GMT

Hi @richgalloway ,

This worked but you made two typo's. It is supposed to be

| eval accountExpires = strftime(strptime(accountExpires, "%Y-%m-%dT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

Thank you very much!

Sasquatchatmars