Hi all,
I have been trying to make a search where i can monitor the expired user accounts. So far i have this
| ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="*"
| table accountExpires sAMAccountName
My problem is the time output. For example, in the AD the time is set to let's say 10/5/2020 12:00:00 AM and Splunk gives 2020-10-04T22:00:00Z as output. I know there Splunk gives it in UTC but we are in GMT+2. Is there a way, without modifying any settings to have the same output as in the AD?
Thank you very much
Sasquatchatmars
You can change the format using strptime() and strftime() like this.
| eval accountExpires = strftime(strptime(accountExpires, "$Y-%m-%dYT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")
Splunk lacks a way to convert time zones. You can add 2 hours to the converted time, but may still display as UTC, which would then be incorrect. See https://ideas.splunk.com/ideas/E-I-27
You can change the format using strptime() and strftime() like this.
| eval accountExpires = strftime(strptime(accountExpires, "$Y-%m-%dYT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")
Splunk lacks a way to convert time zones. You can add 2 hours to the converted time, but may still display as UTC, which would then be incorrect. See https://ideas.splunk.com/ideas/E-I-27
Hi @richgalloway ,
This worked but you made two typo's. It is supposed to be
| eval accountExpires = strftime(strptime(accountExpires, "%Y-%m-%dT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")
Thank you very much!
Sasquatchatmars