topic Re: Display events when current date is >= 30 days from expiration date in Splunk Search

Display events when current date is >= 30 days from expiration date

jsven7 — Tue, 24 Nov 2015 18:41:55 GMT

Spent all day trying to figure this out. The events I'm working with contain a field with an expiration date in Unix epoch time. I'm trying to bring up a table of events when current date is >= 30days before the expiration date. Combed through documentation and Splunk Answers no luck. Thanks in advance.

Example data:

expiration_date=1548910800000

Re: Display events when current date is >= 30 days from expiration date

sundareshr — Tue, 24 Nov 2015 19:03:29 GMT

See if this gives you some ideas...

Re: Display events when current date is >= 30 days from expiration date

woodcock — Tue, 24 Nov 2015 19:41:34 GMT

Like this:

... | eval deltaDays = (now() - expiration_date)/86400 | where deltaDays>=30

Re: Display events when current date is >= 30 days from expiration date

jsven7 — Tue, 24 Nov 2015 20:29:06 GMT

Meant to write '<' instead of '>'. Its not giving events where now() is <= 30days of expiration_date

mysearch... |eval now=now() | eval deltaDays = (now() - expiration_date)/86400 | where deltaDays<=30 | table loginuid, token_serial, now, expiration_date

Re: Display events when current date is >= 30 days from expiration date

woodcock — Tue, 24 Nov 2015 20:58:37 GMT

So did this work for you?

Re: Display events when current date is >= 30 days from expiration date

jsven7 — Mon, 30 Nov 2015 13:04:32 GMT

Sorry for late response was out for Thanksgiving. Hope you enjoyed yours!

I'm trying to test with this:

I expect to see events where the Expiration_date field is <= 30 days from now() but this is not the case. Am I using the where command correctly?

Re: Display events when current date is >= 30 days from expiration date

woodcock — Tue, 01 Dec 2015 14:32:58 GMT

I did not look closely at your sample data and there is a problem there. It is neither in epoch, nor in any encoding that I can discern. If you can convert this to epoch, then my solution will work for you.

Re: Display events when current date is >= 30 days from expiration date

woodcock — Tue, 01 Dec 2015 14:34:53 GMT

Even if I assume it is in milliseconds, this converts to Thu, 31 Jan 2019 05:00:00 GMT!