Splunk Enterprise Security

filter data

numeroinconnu12
Path Finder
Hello everyone, I have a splunk query that returns the connection ranges with the start and end of the connection. Below is an example. user DateMin DateMax 1234 2020-07-14 04:54:21 2020-07-14 06:02:54 I would just like to display connections that last at least 6 minutes. Thanks.
0 Karma

anilchaithu
Builder

@numeroinconnu12 

follow these steps

  • convert the timestamps into epoch, eval DateMin=strptime(DateMin, "%Y-%m-%d %H:%M:%S")
  • difference between the two epoch times will be in seconds, eval Diff=(DateMax-DateMin)
  • convert the difference to min, eval Diff=round(Diff/60,2)
  • add a filter using where command, where Diff > 6

adding all the above steps together 

 

eval DateMin=strptime(DateMin, "%Y-%m-%d %H:%M:%S"), DateMax=strptime(DateMax, "%Y-%m-%d %H:%M:%S") | eval Diff=round((DateMax-DateMin)/60,2) | where Diff > 6

 

you can merge them to a single eval. But I though this will give you good clarity.

 

Hope this helps

0 Karma