Convert AD LDAP Timestamp to Epoch or other readable date

[dwithers]

Using ldapsearch queries in the splunk for windows ifnrastructure app, I am trying to convert the following fields timestamp which is the integer8 windows NT timestamp to epoch or other readable time after my query runs. The timestamp is the number of 100-nanoseconds intervals (1 nanosecond = one billionth of a second) since Jan 1, 1601 UTC

Anyone have any experience with this? Would be much appreciated!

field = msDS-LastSuccessfulInteractiveLogonTime
timestamp returned = 129878945338632316

[MuS · Accepted solution]

Hi dwithers,

take this run everywhere example and adapt it to your needs:

index=_internal | head 1 | eval AD_time="129878945338632316" 
| eval myTime=AD_time/1000000000 
| eval myNiceTime=strftime(myTime, "%F %H:%M:%S.%3Q") 
| table myNiceTime

the first line is only to setup the AD like time field, the second eval will 'convert' it into epoch time and the last eval will create a nice human readable time stamp out of it.

cheers, MuS

[dwithers]

eval myTime=AD_time/10000000 - 11644473600

got it. Thanks for your help!

[dwithers]

he current LDAP time = (time()+11644473600)*10000000;
You can replace time() with any UNIX timestamp or strtotime("15 November 2012") is the math if ound around it

[dwithers]

Actually, i just found it's 64bit in of the number of 100 nanoseconds since 1/1/1601

[MuS]

small update: are you sure these are nano seconds? Looks like there is one number missing in your example....