Splunk Enterprise Security

How to find time values that are over 90 days old?

ajdyer2000
Path Finder

Hi,

I have 2 fields I would like to only display **lastLogonTimestamp** values that are over 90 days of the **_time** value

Thanks

lastLogonTimestamp 
 2018-05-30T03:19:45.368884Z    

_time
2018-06-05T15:25:27.999-04:00
0 Karma
1 Solution

kmaron
Motivator
| eval LastLogon=strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%6N") 
| eval LastLogon90days=LastLogon+(90*24*60*60)
| where LastLogon90days < _time

View solution in original post

kmaron
Motivator
| eval LastLogon=strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%6N") 
| eval LastLogon90days=LastLogon+(90*24*60*60)
| where LastLogon90days < _time

ajdyer2000
Path Finder

Thanks kmaron

That works great

Could you do the same for the following?:

I would like to only display TERMINATION_DT values that are over 90 days of the _time value

TERMINATION_DT
2006-03-09 00:00:00.0

_time
2018-06-07T09:09:42.819-04:00

I appreciate this.

Alan

0 Karma

kmaron
Motivator

It's going to be the same thing. The only change is in the format of the strptime (which you can find here: https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Commontimeformatvariables)

 | eval TERMINATION=strptime(TERMINATION_DT,"%Y-%m-%d %H:%M:%S.%N") 
 | eval TERMINATION90days=TERMINATION+(90*24*60*60)
 | where TERMINATION90days < _time
0 Karma

ajdyer2000
Path Finder

Awesome Thanks

0 Karma

pradeepkumarg
Influencer
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...