Reporting

Count how many days event was

Becherer
Explorer

I am looking to have a search that counts in days when the event was when a person logs in.

When a person resets a password, the dc sends the event to splunk. I am looking to have the timestamp on the event start the clock at 30 days. Every day that passes from the event timestamp of when the person reset the password, I want it to minus a day. I have played around | eval time but can't seem to get the correct search. 

0 Karma
1 Solution

soutamo
SplunkTrust
SplunkTrust

Hi

Maybe something like this:

index=_internal | head 1
| eval _raw = "Name, passwordlastset, epoch
John Blake, 7/25/2020 7:57:24 AM, 1597273844"
| multikv forceheader=1
| rename COMMENT AS "Previous set the sample, locig below"
| eval date_a = round(strptime(passwordlastset, "%m/%d/%Y %H:%M:%S %p"))
| eval day_diff = round(time() - date_a), ds_day = tostring(day_diff, "duration")
| eval days_left = 30 - floor(day_diff / (60*60*24))
| table Name, passwordlastset, day_diff ds_day days_left

You could change floor -> ceil if this was what you are looking.

r. Ismo

View solution in original post

0 Karma

soutamo
SplunkTrust
SplunkTrust

Hi

have you looked 

  • stats + range
  • duration
  • relative_time
  • reltime

r. Ismo

0 Karma

Becherer
Explorer

@soutamo 

I can't say I have. Do you have any information that you could provide as good starting place, ideas on execution?

Thanks.

0 Karma

soutamo
SplunkTrust
SplunkTrust

Can you give some samples of those events  (anonymise those first), so community could better help you?

r. Ismo

0 Karma

Becherer
Explorer

@soutamo 

After doing a search, I get the following fields back.

 

Name: John Blake

passwordlastset: 8/24/2020 7:57:24 AM

epoch:1598273844

 

0 Karma

soutamo
SplunkTrust
SplunkTrust

Hi

Maybe something like this:

index=_internal | head 1
| eval _raw = "Name, passwordlastset, epoch
John Blake, 7/25/2020 7:57:24 AM, 1597273844"
| multikv forceheader=1
| rename COMMENT AS "Previous set the sample, locig below"
| eval date_a = round(strptime(passwordlastset, "%m/%d/%Y %H:%M:%S %p"))
| eval day_diff = round(time() - date_a), ds_day = tostring(day_diff, "duration")
| eval days_left = 30 - floor(day_diff / (60*60*24))
| table Name, passwordlastset, day_diff ds_day days_left

You could change floor -> ceil if this was what you are looking.

r. Ismo

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!