Creating a table that includes a column for date/time of an event

Kuronoa — Thu, 03 Jun 2021 02:19:51 GMT

Hello! I'll try to keep things as brief and concise as I can, but what you need to know is that I'm currently building a dashboard that tracks various criteria of windows machines, and depending on the conditions of these criteria, a score is assigned to each category, and when a specific host reaches a high enough score, it is considered for decommission.

One of the criteria involved with determining the scoring for whether or the likelihood of a host needing decommission is how long ago somehow has logged into said host.

I was wondering if anyone had any suggestions as to run a search and use eval to add a column containing the recorded time each windows event was received

below is an example of what one of the splunk events looks like using our index

And here is a mockup designed to help better explain what I'm trying to do here:

Thanks for taking the time to read my question!

Re: Creating a table that includes a column for date/time of an event

ITWhisperer — Thu, 03 Jun 2021 05:01:11 GMT

| eval dayssincelastlogin=(relative_time(now(),"@d")-strptime(lastlogindate,"%m/%d/%Y"))/(60*60*24)

topic Re: Creating a table that includes a column for date/time of an event in Splunk Search

Creating a table that includes a column for date/time of an event

Re: Creating a table that includes a column for date/time of an event