System login after hours

New Member

I had requested help with a "search language that could determine system logins after core hours" and one of the nice people here puts the below search together for me. does this search need any revisions or is it incomplete? if it does need some revisions can anyone help with such revisions please?

definition = | eval day=strftime(_time,"%d/%m/%Y")\
| lookup SIEMCAL.csv day OUTPUT type\
| search Tipo=2 OR (Tipo=1 (date_hour>14 OR (date_hour<7 AND date_minute<45))) OR (Tipo=0 (date_hour>20 OR (date_hour<8 AND date_minute<45)))
iseval = 0

Tags (1)
0 Karma


Hi @essibong1,
sorry, probably I wasn't so clear in my previous answer!

this is a macro definition that I hinted in my answer to your previous question ( 😞 I used a macro to have in only one point the working time definition so I can modify it in only one point instead in each search of my app.

Anyway, if you don't want to use a macro, you have to create your search starting from the filter for the access events (e.g. in windows EventCode=4624) and then filter for the hours and minutes.

The other needed information is if you want only to filter for time or you want also to filter for holydays:

if you want to filter only for time, you can run something like this (working time 8.00 - 17.00):

index=your_index EventCode=4624 (date_hour<8 OR date_hour>18)
| ...

If instead you want also holydays (using the lookup), you have to create a lookup (called e.g. SIEMCAL.csv) containing two information:

  • day in a format you like (e.g. dd/mm/yyyy),
  • type (0 for working time, 1 for half working time, 2 for holydays).

So for windows systems you can run something like this:

index=your_index EventCode=4624 
| eval day=strftime(_time,"%d/%m/%Y")
| lookup SIEMCAL.csv day OUTPUT type
| search type=2 OR (Tipo=1 (date_hour>14 OR (date_hour<8)) OR (type=0 (date_hour>18 OR date_hour<8)))
| ...


0 Karma

Ultra Champion

That's not a search, it is a macro.

Maybe easier to just continue in the original question:

As I mentioned there, there are some serious caveats with that macro, so I'd not recommend using it like that. Especially if you apparently don't understand what it does.

There were some good comments and questions on your previous post. I'd start with looking at those and responding to the clarification questions that were asked there. Otherwise it is not really possible to provide a lot of help.

0 Karma


That doesn't look like a search. It looks like a macro definition.
Your best option is to ask the person who gave you the information.

If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!