https://community.splunk.com/t5/Splunk-Search/Another-time-date-string-query/m-p/334633#M165495 <P>Hi<BR /> you don't convert <CODE>time</CODE> in human readable but in epochtime using <CODE>time=strptime(lastlogondate,"%d/%m/%Y %H:%M")</CODE><BR /> if you want a human readable format you have to use <CODE>strftime</CODE>.<BR /> Bye.<BR /> Giuseppe</P> Thu, 26 Oct 2017 08:01:59 GMT gcusello 2017-10-26T08:01:59Z https://community.splunk.com/t5/Splunk-Search/Another-time-date-string-query/m-p/334632#M165494 <P>Hi All, </P> <P>I am recently new to SPLUNK and trying to identify a way of doing some time differences. I have done an export for the enabled devices in AD and their last logon times. An example of a result is</P> <P>HOSTNUMBER1,HOSTNUMBER1.domain.com,Windows Server 2008, 26/10/2017 7:40</P> <P>From my list I have strung together the following query</P> <P>index=adlastlogondate AND sourcetype=csv | eval currenttime=strftime(now(),"%d/%m/%Y %H:%M") | eval time=strptime(lastlogondate,"%d/%m/%Y %H:%M") eval timedifference=lastlogontime-today | table hostname time lastlogondate currenttime timedifference | sort time</P> <P>This generates the following result (NOTE: using "|" to denote columns in the table). Note I get no time difference (which is likely due to this bring a string)</P> <HR /> <P>Hostname | time | lastlogondate | currenttime | timedifference</P> <P>HOSTNUMBER1 | 12114214569.000000 | 25/10/2017 01:00 | 26/10/2017 15:16 | </P> <HR /> <P>I tried running this to convert the string into an epoch time(?) to try this but I get the same result</P> <P>index=adlastlogondate AND sourcetype=csv | eval currenttime=strftime(now(),"%d/%m/%Y %H:%M") | eval time=strptime(lastlogondate,"%d/%m/%Y %H:%M") | convert ctime(time) AS lastlogontime | convert ctime(currenttime) AS today |eval timedifference=lastlogontime-today | table hostname time lastlogondate currenttime timedifference | sort time</P> <P>Where am I going wrong? </P> Thu, 26 Oct 2017 07:22:06 GMT https://community.splunk.com/t5/Splunk-Search/Another-time-date-string-query/m-p/334632#M165494 willadams 2017-10-26T07:22:06Z https://community.splunk.com/t5/Splunk-Search/Another-time-date-string-query/m-p/334633#M165495 <P>Hi<BR /> you don't convert <CODE>time</CODE> in human readable but in epochtime using <CODE>time=strptime(lastlogondate,"%d/%m/%Y %H:%M")</CODE><BR /> if you want a human readable format you have to use <CODE>strftime</CODE>.<BR /> Bye.<BR /> Giuseppe</P> Thu, 26 Oct 2017 08:01:59 GMT https://community.splunk.com/t5/Splunk-Search/Another-time-date-string-query/m-p/334633#M165495 gcusello 2017-10-26T08:01:59Z