Splunk Enterprise Security

How to find time values that are over 90 days old?

ajdyer2000
Engager

Hi,

I have 2 fields I would like to only display **lastLogonTimestamp** values that are over 90 days of the **_time** value

Thanks

lastLogonTimestamp 
 2018-05-30T03:19:45.368884Z    

_time
2018-06-05T15:25:27.999-04:00
0 Karma
1 Solution

kmaron
Motivator
| eval LastLogon=strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%6N") 
| eval LastLogon90days=LastLogon+(90*24*60*60)
| where LastLogon90days < _time

View solution in original post

kmaron
Motivator
| eval LastLogon=strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%6N") 
| eval LastLogon90days=LastLogon+(90*24*60*60)
| where LastLogon90days < _time

View solution in original post

ajdyer2000
Engager

Thanks kmaron

That works great

Could you do the same for the following?:

I would like to only display TERMINATION_DT values that are over 90 days of the _time value

TERMINATION_DT
2006-03-09 00:00:00.0

_time
2018-06-07T09:09:42.819-04:00

I appreciate this.

Alan

0 Karma

kmaron
Motivator

It's going to be the same thing. The only change is in the format of the strptime (which you can find here: https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Commontimeformatvariables)

 | eval TERMINATION=strptime(TERMINATION_DT,"%Y-%m-%d %H:%M:%S.%N") 
 | eval TERMINATION90days=TERMINATION+(90*24*60*60)
 | where TERMINATION90days < _time
0 Karma

ajdyer2000
Engager

Awesome Thanks

0 Karma

pradeepkumarg
Influencer
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!