Date extraction command Question for LDAP dump

daryllj — Thu, 29 Apr 2021 20:44:16 GMT

hi there- I tried a few things already, but looking to get guidence on this one- I am using the LDAP query module in Splunk to dump out directory information and then present into a simple table, and running into a challenge simplifying extraction of the date from the AD account creation field:

| ldapsearch basedn="XXXXXXXXXXX" search="(&(objectCategory=user)(objectClass=user)(distinguishedName=*))" attrs="displayName,distinguishedName,mail,lastLogonTimestamp,whenCreated"

I want to simplify presentation of the two date and time fields: lasLogonTimestamp and whenCreated.

What I get with these fields today when I output to a table (example)

2019-05-06 16:53:24+00:00

What I want to see:

2019-05-06

What I have tried:

adding in:

| eval Created=strftime(whenCreated,"%Y%m%d") | prior to my table command.

this seems to result in nothing being populated in the new field (I am expecting just a date value) ...I am not sure if the strftime command is correct when it comes to this format of data...

thoughts welcomed as always

Re: Date extraction command Question for LDAP dump

richgalloway — Fri, 30 Apr 2021 12:23:08 GMT

To convert a timestamp from one string format into another string format you must first convert it into an integer using strptime.

| eval Created=strftime(strptime(whenCreated,"%Y-%m-%d %H:%M:%S%:z"),"%Y-%m-%d") |

Re: Date extraction command Question for LDAP dump

daryllj — Fri, 30 Apr 2021 15:39:08 GMT

Thanks for taking the time out to educate me on this one- works perfectly, I really appreciate you taking a few minutes of your time!

topic Date extraction command Question for LDAP dump in Splunk Search

Date extraction command Question for LDAP dump

Re: Date extraction command Question for LDAP dump

Re: Date extraction command Question for LDAP dump