Change Time Format of ldapsearch attribute AccountExpired

[Sasquatchatmars]

Hi all,

I have been trying to make a search where i can monitor the expired user accounts. So far i have this

| ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="*"
| table accountExpires sAMAccountName

My problem is the time output. For example, in the AD the time is set to let's say 10/5/2020 12:00:00 AM and Splunk gives 2020-10-04T22:00:00Z as output. I know there Splunk gives it in UTC but we are in GMT+2. Is there a way, without modifying any settings to have the same output as in the AD? 

Thank you very much

Sasquatchatmars

[richgalloway · Accepted solution]

You can change the format using strptime() and strftime() like this.

| eval accountExpires = strftime(strptime(accountExpires, "$Y-%m-%dYT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

Splunk lacks a way to convert time zones.  You can add 2 hours to the converted time, but may still display as UTC, which would then be incorrect.  See https://ideas.splunk.com/ideas/E-I-27

[Sasquatchatmars]

Hi @richgalloway ,

This worked but you made two typo's. It is supposed to be

| eval accountExpires = strftime(strptime(accountExpires, "%Y-%m-%dT%H:%M:%S%Z"), "%d/%m/%Y %H:%M:%S %p")

Thank you very much! 

Sasquatchatmars