Splunk Enterprise Security

filter data

numeroinconnu12
Path Finder
Hello everyone, I have a splunk query that returns the connection ranges with the start and end of the connection. Below is an example. user DateMin DateMax 1234 2020-07-14 04:54:21 2020-07-14 06:02:54 I would just like to display connections that last at least 6 minutes. Thanks.
0 Karma

anilchaithu
Builder

@numeroinconnu12 

follow these steps

  • convert the timestamps into epoch, eval DateMin=strptime(DateMin, "%Y-%m-%d %H:%M:%S")
  • difference between the two epoch times will be in seconds, eval Diff=(DateMax-DateMin)
  • convert the difference to min, eval Diff=round(Diff/60,2)
  • add a filter using where command, where Diff > 6

adding all the above steps together 

 

eval DateMin=strptime(DateMin, "%Y-%m-%d %H:%M:%S"), DateMax=strptime(DateMax, "%Y-%m-%d %H:%M:%S") | eval Diff=round((DateMax-DateMin)/60,2) | where Diff > 6

 

you can merge them to a single eval. But I though this will give you good clarity.

 

Hope this helps

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...