Getting Data In
Highlighted

How do you alert on a date change in Windows Security Logs?

New Member

Hello,

I am looking to create an alert when a date change of more than a minute in Windows Security Logs.

in my log, I have these two elements (PreviousTime and NexTime) that I would like to compare, but I cannot create the filter.

Previous Time: ‎2018‎-‎12‎-‎26T09:36:32.959975900Z
New Time: ‎2018‎-‎12‎-‎26T09:36:32.959000000Z

I would like to compare these two variables and trigger an alert if the result is greater than one minute.

Any ideas ?

0 Karma
Highlighted

Re: How do you alert on a date change in Windows Security Logs?

Motivator

Hello @zmmt,

Convert your timestamps to epoch objects using strptime().

Then you can easily calculate the time difference in seconds:

| makeresults count=1 | fields - _time
| eval Previous_Time="2018-12-26T09:36:32.959975900Z"
| eval New_Time="2018-12-26T09:36:32.959000000Z"
| eval Previous_Time_Epoch=strptime(Previous_Time,"%Y-%m-%dT%H:%M:%S.%9N")
| eval New_Time_Epoch=strptime(New_Time,"%Y-%m-%dT%H:%M:%S.%9N")
| eval diff=abs(New_Time_Epoch-Previous_Time_Epoch)

The result for your sample event is:

 Previous_Time_Epoch    New_Time_Epoch        diff
 1545816992.959975      1545816992.959000     0.000975

And now filter for:

| search diff>60

I'm not sure though what the "Z" in your timestamps stands for.

0 Karma
Highlighted

Re: How do you alert on a date change in Windows Security Logs?

Splunk Employee
Splunk Employee

hi @zmmt,

Did you have a chance to check out WHRG's answer? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya.

Thanks for posting!

0 Karma