Reporting

Count how many days event was

Becherer
Explorer

I am looking to have a search that counts in days when the event was when a person logs in.

When a person resets a password, the dc sends the event to splunk. I am looking to have the timestamp on the event start the clock at 30 days. Every day that passes from the event timestamp of when the person reset the password, I want it to minus a day. I have played around | eval time but can't seem to get the correct search. 

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

Maybe something like this:

index=_internal | head 1
| eval _raw = "Name, passwordlastset, epoch
John Blake, 7/25/2020 7:57:24 AM, 1597273844"
| multikv forceheader=1
| rename COMMENT AS "Previous set the sample, locig below"
| eval date_a = round(strptime(passwordlastset, "%m/%d/%Y %H:%M:%S %p"))
| eval day_diff = round(time() - date_a), ds_day = tostring(day_diff, "duration")
| eval days_left = 30 - floor(day_diff / (60*60*24))
| table Name, passwordlastset, day_diff ds_day days_left

You could change floor -> ceil if this was what you are looking.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you looked 

  • stats + range
  • duration
  • relative_time
  • reltime

r. Ismo

0 Karma

Becherer
Explorer

@isoutamo 

I can't say I have. Do you have any information that you could provide as good starting place, ideas on execution?

Thanks.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you give some samples of those events  (anonymise those first), so community could better help you?

r. Ismo

0 Karma

Becherer
Explorer

@isoutamo 

After doing a search, I get the following fields back.

 

Name: John Blake

passwordlastset: 8/24/2020 7:57:24 AM

epoch:1598273844

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Maybe something like this:

index=_internal | head 1
| eval _raw = "Name, passwordlastset, epoch
John Blake, 7/25/2020 7:57:24 AM, 1597273844"
| multikv forceheader=1
| rename COMMENT AS "Previous set the sample, locig below"
| eval date_a = round(strptime(passwordlastset, "%m/%d/%Y %H:%M:%S %p"))
| eval day_diff = round(time() - date_a), ds_day = tostring(day_diff, "duration")
| eval days_left = 30 - floor(day_diff / (60*60*24))
| table Name, passwordlastset, day_diff ds_day days_left

You could change floor -> ceil if this was what you are looking.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...