topic Re: convert time field in Splunk Search

convert time field

gdavid — Fri, 08 Apr 2016 02:36:05 GMT

i have the last sync time for my activesync clients going to splunk via powershell input.
ex: LastSyncAttemptTime = 04/07/2016 21:49:08
this produces a text field that is not sortable or useable.
i tried to convert it using:

| eval lastSync=strptime(LastSyncAttemptTime,"%x %T") | table lastSync

with no luck. i have tired numerous variations of %codes to list the date and time, and a few variations produce a decimal value.

my end goal here is to look for clients that last synced over 30 days ago.

any ideas?

thanks

Re: convert time field

MuS — Fri, 08 Apr 2016 03:18:47 GMT

Hi gdavid,

you can try this instead:

| eval lastSync=strptime(LastSyncAttemptTime, "%m/%d/%Y %H:%M:%S")

Hope this helps ...

cheers, MuS

Re: convert time field

gdavid — Fri, 08 Apr 2016 12:00:16 GMT

that yields:

LastSyncAttemptTime
04/08/2016 07:19:46

lastSync
1460114386.000000

which looks like it converted it into epoch time. convert again?

Re: convert time field

MuS — Fri, 08 Apr 2016 12:10:35 GMT

What is your intention / use case? please explain a bit further otherwise no one will be able to help you in the end 😉

Re: convert time field

gdavid — Fri, 08 Apr 2016 12:20:34 GMT

this seems to be working to generate the field in human readable format

lastSync=strftime(strptime(LastSyncAttemptTime, "%m/%d/%Y %H:%M:%S"),"%m/%d/%y %H:%M:%S")

what i realized is to finish the rest of the search it was easier to leave it in epoch time. use this for now:

| eval lastSync=strptime(LastSyncAttemptTime, "%m/%d/%Y %H:%M:%S") | eval lastsyncbad = relative_time(now(), "-30d" ) | where lastSync < lastsyncbad

there might be a more effective method but this works.

Re: convert time field

gdavid — Fri, 08 Apr 2016 12:21:22 GMT

from above: my end goal here is to look for clients that last synced over 30 days ago.