Splunk Enterprise Security

Change Time Format of ldapsearch attribute AccountExpired

Sasquatchatmars
Communicator

Hi all,

I have been trying to make a search where i can monitor the expired user accounts. So far i have this

 

| ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="*"
| table accountExpires sAMAccountName

 

My problem is the time output. For example, in the AD the time is set to let's say 10/5/2020 12:00:00 AM and Splunk gives 2020-10-04T22:00:00Z as output. I know there Splunk gives it in UTC but we are in GMT+2. Is there a way, without modifying any settings to have the same output as in the AD? 

Thank you very much

Sasquatchatmars

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can change the format using strptime() and strftime() like this.

| eval accountExpires = strftime(strptime(accountExpires, "$Y-%m-%dYT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

Splunk lacks a way to convert time zones.  You can add 2 hours to the converted time, but may still display as UTC, which would then be incorrect.  See https://ideas.splunk.com/ideas/E-I-27

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can change the format using strptime() and strftime() like this.

| eval accountExpires = strftime(strptime(accountExpires, "$Y-%m-%dYT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

Splunk lacks a way to convert time zones.  You can add 2 hours to the converted time, but may still display as UTC, which would then be incorrect.  See https://ideas.splunk.com/ideas/E-I-27

---
If this reply helps you, Karma would be appreciated.

Sasquatchatmars
Communicator

Hi @richgalloway ,

This worked but you made two typo's. It is supposed to be

 

| eval accountExpires = strftime(strptime(accountExpires, "%Y-%m-%dT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

 

Thank you very much! 

Sasquatchatmars

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...