How to edit my ldapsearch to find a user's last login age (lastLogonTimestamp - current time)?

[maclel]

Hi,

With an LDAP search (ldapsearch), how do I go about getting a user's lastLogonTimestamp minus the current time (of search), in say days. i.e. someone hasn't logged in since 2016-06-02T00:00:00.000000Z is roughly 60 days...

Current search is:

| ldapsearch domain=internal search="(&(objectclass=user)(!(objectClass=computer)))" limit=10 attrs="sAMAccountName, displayName, distinguishedName, userAccountControl, whenCreated, accountExpires, lastLogonTimestamp"
| makemv userAccountControl
| search dn!="*OU=_Disabled Users*"
| eval accountDisable=if(userAccountControl == "ACCOUNTDISABLE
NORMAL_ACCOUNT", "Yes", "No")
| eval dontExpirePasswd=if(userAccountControl="DONT_EXPIRE_PASSWD
NORMAL_ACCOUNT", "Yes", "No")
| eval passwdNotRequired=if(userAccountControl == "PASSWD_NOTREQD
NORMAL_ACCOUNT", "Yes", "No")
| eval lastLoginAge=(lastLogonTimestamp - now())
| table sAMAccountName, displayName, dn, userAccountControl, whenCreated, accountDisable, dontExpirePasswd, passwdNotRequired, lastLoginAge, lastLogonTimestamp, accountExpires

Just not sure which eval time function command to use.

Environment:
Linux 6.3.3 Splunk Enterprise servers
MSInfra 1.3.0
SA-ldapsearch 2.1.3
Splunk Add-on for Microsoft Active Directory 1.0.0 (deployed to a couple DCs via UFs)

[sundareshr · Accepted solution]

For time compares, you have to first convert the time to epoch format (seconds). The difference between two times, is always in seconds. So, to get the time in days, you can divide by 86400 (secs per day)

| ldapsearch domain=internal search="(&(objectclass=user)(!(objectClass=computer)))" limit=10 attrs="sAMAccountName, displayName, distinguishedName, userAccountControl, whenCreated, accountExpires, lastLogonTimestamp"
 | makemv userAccountControl
 | search dn!="*OU=_Disabled Users*"
 | eval accountDisable=if(userAccountControl == "ACCOUNTDISABLE
 NORMAL_ACCOUNT", "Yes", "No")
 | eval dontExpirePasswd=if(userAccountControl="DONT_EXPIRE_PASSWD
 NORMAL_ACCOUNT", "Yes", "No")
 | eval passwdNotRequired=if(userAccountControl == "PASSWD_NOTREQD
 NORMAL_ACCOUNT", "Yes", "No")
| eval lastLoginAge_epoch=strptime(lastLogonTimestamp, "%Y-%m-%dT%H:%M:%S")
 | eval lastLoginAge=round((lastLoginAge_epoch - now())/86400, 0)
 | table sAMAccountName, displayName, dn, userAccountControl, whenCreated, accountDisable, dontExpirePasswd, passwdNotRequired, lastLoginAge, lastLogonTimestamp, accountExpires