Splunk Enterprise Security

Change Time Format of ldapsearch attribute AccountExpired

Sasquatchatmars
Communicator

Hi all,

I have been trying to make a search where i can monitor the expired user accounts. So far i have this

 

| ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="*"
| table accountExpires sAMAccountName

 

My problem is the time output. For example, in the AD the time is set to let's say 10/5/2020 12:00:00 AM and Splunk gives 2020-10-04T22:00:00Z as output. I know there Splunk gives it in UTC but we are in GMT+2. Is there a way, without modifying any settings to have the same output as in the AD? 

Thank you very much

Sasquatchatmars

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can change the format using strptime() and strftime() like this.

| eval accountExpires = strftime(strptime(accountExpires, "$Y-%m-%dYT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

Splunk lacks a way to convert time zones.  You can add 2 hours to the converted time, but may still display as UTC, which would then be incorrect.  See https://ideas.splunk.com/ideas/E-I-27

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can change the format using strptime() and strftime() like this.

| eval accountExpires = strftime(strptime(accountExpires, "$Y-%m-%dYT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

Splunk lacks a way to convert time zones.  You can add 2 hours to the converted time, but may still display as UTC, which would then be incorrect.  See https://ideas.splunk.com/ideas/E-I-27

---
If this reply helps you, Karma would be appreciated.

Sasquatchatmars
Communicator

Hi @richgalloway ,

This worked but you made two typo's. It is supposed to be

 

| eval accountExpires = strftime(strptime(accountExpires, "%Y-%m-%dT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

 

Thank you very much! 

Sasquatchatmars

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...