I am looking to have a search that counts in days when the event was when a person logs in.
When a person resets a password, the dc sends the event to splunk. I am looking to have the timestamp on the event start the clock at 30 days. Every day that passes from the event timestamp of when the person reset the password, I want it to minus a day. I have played around | eval time but can't seem to get the correct search.
Hi
Maybe something like this:
index=_internal | head 1
| eval _raw = "Name, passwordlastset, epoch
John Blake, 7/25/2020 7:57:24 AM, 1597273844"
| multikv forceheader=1
| rename COMMENT AS "Previous set the sample, locig below"
| eval date_a = round(strptime(passwordlastset, "%m/%d/%Y %H:%M:%S %p"))
| eval day_diff = round(time() - date_a), ds_day = tostring(day_diff, "duration")
| eval days_left = 30 - floor(day_diff / (60*60*24))
| table Name, passwordlastset, day_diff ds_day days_left
You could change floor -> ceil if this was what you are looking.
r. Ismo
Hi
have you looked
r. Ismo
I can't say I have. Do you have any information that you could provide as good starting place, ideas on execution?
Thanks.
Can you give some samples of those events (anonymise those first), so community could better help you?
r. Ismo
After doing a search, I get the following fields back.
Name: John Blake
passwordlastset: 8/24/2020 7:57:24 AM
epoch:1598273844
Hi
Maybe something like this:
index=_internal | head 1
| eval _raw = "Name, passwordlastset, epoch
John Blake, 7/25/2020 7:57:24 AM, 1597273844"
| multikv forceheader=1
| rename COMMENT AS "Previous set the sample, locig below"
| eval date_a = round(strptime(passwordlastset, "%m/%d/%Y %H:%M:%S %p"))
| eval day_diff = round(time() - date_a), ds_day = tostring(day_diff, "duration")
| eval days_left = 30 - floor(day_diff / (60*60*24))
| table Name, passwordlastset, day_diff ds_day days_left
You could change floor -> ceil if this was what you are looking.
r. Ismo