topic Re: Help on SystemTime format and SystemTime stats in Splunk Search

Help on SystemTime format and SystemTime stats

jip31 — Mon, 25 Mar 2019 13:27:36 GMT

I use the search below but SystemTime doesnt return results
SystemTime format is like this : '2019-03-25T03:49:42.458421900Z'
What is the issue please?

index="x" sourcetype=x (EventCode=6005 OR EventCode=6006) 
| eval SystemTime=strftime(strptime(SystemTime, "%Y-%m-%dT%H:%M:%S.%9Q%Z"), "%y-%m-%d %H:%M") 
| table host SystemTime

I also want to stats in a table the latest SystemTime for EventCode=6005 and the latest SystemTime for EventCode=6006)
Something like this :

| stats latest(6005) as LastLogon, latest(6006) as LastReboot by host 
| sort -LastLogon -LastReboot

Could you help me please??

Re: Help on SystemTime format and SystemTime stats

somesoni2 — Mon, 25 Mar 2019 14:10:21 GMT

When you run below query, does the value shown in the table has single quotes in them?

index="x" sourcetype=x (EventCode=6005 OR EventCode=6006) 
 | table host SystemTime

For your second requirement, try like this

index="x" sourcetype=x (EventCode=6005 OR EventCode=6006) 
| stats latest(SystemTime) as SystemTime by host EventCode
| xyseries host EventCode SystemTime | rename "6005" as LastLogon "6006" as LastReboot
| sort -LastLogon -LastReboot

Update - working solution for time conversion

index="x" sourcetype=x (EventCode=6005 OR EventCode=6006) 
  | eval SystemTime=strftime(strptime(SystemTime, "'%Y-%m-%dT%H:%M:%S.%9Q%Z'"), "%y-%m-%d %H:%M") 
  | table host SystemTime

Re: Help on SystemTime format and SystemTime stats

jip31 — Wed, 27 Mar 2019 11:29:31 GMT

yes there is single quote
I have changed it in my eval but it doesnt works....
Thanks for the second requirement its good

Re: Help on SystemTime format and SystemTime stats

somesoni2 — Wed, 27 Mar 2019 16:22:21 GMT

Give this a try (single quotes are added to strptime function time format)

index="x" sourcetype=x (EventCode=6005 OR EventCode=6006) 
 | eval SystemTime=strftime(strptime(SystemTime, "'%Y-%m-%dT%H:%M:%S.%9Q%Z'"), "%y-%m-%d %H:%M") 
 | table host SystemTime

Re: Help on SystemTime format and SystemTime stats

jip31 — Thu, 28 Mar 2019 05:58:46 GMT

perfect it works!! thanks

Re: Help on SystemTime format and SystemTime stats

jip31 — Thu, 28 Mar 2019 06:56:51 GMT

I dont know why but i cant accept your answer

Re: Help on SystemTime format and SystemTime stats

somesoni2 — Thu, 28 Mar 2019 14:27:44 GMT

I converted my comments to answer now. You should be able to close it now.