Getting Data In

How do you alert on a date change in Windows Security Logs?

zmmt
New Member

Hello,

I am looking to create an alert when a date change of more than a minute in Windows Security Logs.

in my log, I have these two elements (Previous_Time and Nex_Time) that I would like to compare, but I cannot create the filter.

Previous Time: ‎2018‎-‎12‎-‎26T09:36:32.959975900Z
New Time: ‎2018‎-‎12‎-‎26T09:36:32.959000000Z

I would like to compare these two variables and trigger an alert if the result is greater than one minute.

Any ideas ?

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @zmmt,

Did you have a chance to check out WHRG's answer? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya.

Thanks for posting!

0 Karma

whrg
Motivator

Hello @zmmt,

Convert your timestamps to epoch objects using strptime().

Then you can easily calculate the time difference in seconds:

| makeresults count=1 | fields - _time
| eval Previous_Time="2018-12-26T09:36:32.959975900Z"
| eval New_Time="2018-12-26T09:36:32.959000000Z"
| eval Previous_Time_Epoch=strptime(Previous_Time,"%Y-%m-%dT%H:%M:%S.%9N")
| eval New_Time_Epoch=strptime(New_Time,"%Y-%m-%dT%H:%M:%S.%9N")
| eval diff=abs(New_Time_Epoch-Previous_Time_Epoch)

The result for your sample event is:

 Previous_Time_Epoch    New_Time_Epoch        diff
 1545816992.959975      1545816992.959000     0.000975

And now filter for:

| search diff>60

I'm not sure though what the "Z" in your timestamps stands for.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...