topic Help creating a search that monitors after hour employee login in Splunk Search

Help creating a search that monitors after hour employee login

essibong1 — Wed, 11 Dec 2019 16:15:52 GMT

Hello,
I had requested for anyone to provide me with a good search to monitor after hour employee login and I was provided with what doesn't seem to be a search but rather looks like a macro definition as you can see below.

 [out_working_time]
 definition = | eval day=strftime(_time,"%d/%m/%Y")\
 | lookup SIEMCAL.csv day OUTPUT type\
 | search Tipo=2 OR (Tipo=1 (date_hour>14 OR (date_hour<7 AND date_minute<45))) OR (Tipo=0 (date_hour>20 OR (date_hour<8 AND date_minute<45)))
 iseval = 0

Can anyone help me with this search, please?

Re: Help creating a search that monitors after hour employee login

aberkow — Wed, 11 Dec 2019 16:39:31 GMT

If you have the logs of employee login, it should be pretty easy to extract the hour out of the timestamp and run an alert on whatever timeframe (after 5 PM and before 8 AM, or whatever you want) like so:

| makeresults count=3 # in your case this is your base search where you pull in logs
| eval hour=strftime(_time,"%H") # parse out the hour from the _time field
| search hour>17 OR hour < 8 # filter down to just logins after 5 PM or before 8 AM for example

Does this make sense/answer your question?