How do you alert on a date change in Windows Security Logs?

[zmmt]

Hello,

I am looking to create an alert when a date change of more than a minute in Windows Security Logs.

in my log, I have these two elements (Previous_Time and Nex_Time) that I would like to compare, but I cannot create the filter.

Previous Time: ‎2018‎-‎12‎-‎26T09:36:32.959975900Z
New Time: ‎2018‎-‎12‎-‎26T09:36:32.959000000Z

I would like to compare these two variables and trigger an alert if the result is greater than one minute.

Any ideas ?

[mstjohn_splunk]

hi @zmmt,

Did you have a chance to check out WHRG's answer? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya.

Thanks for posting!

[whrg]

Hello @zmmt,

Convert your timestamps to epoch objects using strptime().

Then you can easily calculate the time difference in seconds:

| makeresults count=1 | fields - _time
| eval Previous_Time="2018-12-26T09:36:32.959975900Z"
| eval New_Time="2018-12-26T09:36:32.959000000Z"
| eval Previous_Time_Epoch=strptime(Previous_Time,"%Y-%m-%dT%H:%M:%S.%9N")
| eval New_Time_Epoch=strptime(New_Time,"%Y-%m-%dT%H:%M:%S.%9N")
| eval diff=abs(New_Time_Epoch-Previous_Time_Epoch)

The result for your sample event is:

 Previous_Time_Epoch    New_Time_Epoch        diff
 1545816992.959975      1545816992.959000     0.000975

And now filter for:

| search diff>60

I'm not sure though what the "Z" in your timestamps stands for.