Count how many days event was

[Becherer]

I am looking to have a search that counts in days when the event was when a person logs in.

When a person resets a password, the dc sends the event to splunk. I am looking to have the timestamp on the event start the clock at 30 days. Every day that passes from the event timestamp of when the person reset the password, I want it to minus a day. I have played around | eval time but can't seem to get the correct search. 

[isoutamo]

Hi

have you looked 

• stats + range
• duration
• relative_time
• reltime

r. Ismo

[Becherer]

@isoutamo 

I can't say I have. Do you have any information that you could provide as good starting place, ideas on execution?

Thanks.

[isoutamo]

Can you give some samples of those events  (anonymise those first), so community could better help you?

r. Ismo

[Becherer]

@isoutamo 

After doing a search, I get the following fields back.

Name: John Blake

passwordlastset: 8/24/2020 7:57:24 AM

epoch:1598273844

[isoutamo · Accepted solution]

Hi

Maybe something like this:

index=_internal | head 1
| eval _raw = "Name, passwordlastset, epoch
John Blake, 7/25/2020 7:57:24 AM, 1597273844"
| multikv forceheader=1
| rename COMMENT AS "Previous set the sample, locig below"
| eval date_a = round(strptime(passwordlastset, "%m/%d/%Y %H:%M:%S %p"))
| eval day_diff = round(time() - date_a), ds_day = tostring(day_diff, "duration")
| eval days_left = 30 - floor(day_diff / (60*60*24))
| table Name, passwordlastset, day_diff ds_day days_left

You could change floor -> ceil if this was what you are looking.

r. Ismo