Splunk Enterprise Security

Change Time Format of ldapsearch attribute AccountExpired

Sasquatchatmars
Communicator

Hi all,

I have been trying to make a search where i can monitor the expired user accounts. So far i have this

 

| ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="*"
| table accountExpires sAMAccountName

 

My problem is the time output. For example, in the AD the time is set to let's say 10/5/2020 12:00:00 AM and Splunk gives 2020-10-04T22:00:00Z as output. I know there Splunk gives it in UTC but we are in GMT+2. Is there a way, without modifying any settings to have the same output as in the AD? 

Thank you very much

Sasquatchatmars

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can change the format using strptime() and strftime() like this.

| eval accountExpires = strftime(strptime(accountExpires, "$Y-%m-%dYT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

Splunk lacks a way to convert time zones.  You can add 2 hours to the converted time, but may still display as UTC, which would then be incorrect.  See https://ideas.splunk.com/ideas/E-I-27

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can change the format using strptime() and strftime() like this.

| eval accountExpires = strftime(strptime(accountExpires, "$Y-%m-%dYT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

Splunk lacks a way to convert time zones.  You can add 2 hours to the converted time, but may still display as UTC, which would then be incorrect.  See https://ideas.splunk.com/ideas/E-I-27

---
If this reply helps you, Karma would be appreciated.

Sasquatchatmars
Communicator

Hi @richgalloway ,

This worked but you made two typo's. It is supposed to be

 

| eval accountExpires = strftime(strptime(accountExpires, "%Y-%m-%dT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

 

Thank you very much! 

Sasquatchatmars

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...