Splunk Enterprise

Can you help me display a field date based on the following conditions?

jip31
Motivator

Hello

In the query below I want to display the LasLogon and LastReboot fields from the following date conditions:

I just want to display a result if LastLogon < 2 days from the current day and if LastReboot >10 days from the current day

Could you help me please??

index="ai-wkst-windows-wmi-fr" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot") 
| eval LastLogon = strftime(strptime(LastLogon,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
| rex field=LastLogon mode=sed "s/\..*$//" 
| eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
| rex field=LastBootUpTime mode=sed "s/\..*$//" 
| append 
    [ search index="ai-wkst-windows-fr" sourcetype="tools:flags" filename="hty" 
    | dedup host] 
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host
Tags (1)
0 Karma

493669
Super Champion

First convert LastLogon and LastBootUpTime time into epoch.
Then using relative_time function find second last day and next 10 days epoch value
lastly compare these epoch values

| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S")
| eval LastBootUpTime = strptime(LastBootUpTime,"%Y%m%d%H%M%S")
| eval secondlastday=relative_time(now(), "-2d@d")
| eval nexttendays=relative_time(now(), "10d@d")
| where (LastLogon <secondlastday) AND (LastBootUpTime >nexttendays)
0 Karma

jip31
Motivator

perfect thanks!

0 Karma

jip31
Motivator

Hi

I am surprised to have no results even if I play with relative time et even if normally I should have results could you please tell me if the entire request is good please??

index="ai-wkst-windows-wmi-fr" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot") 
 | eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S")
 | eval LastBootUpTime = strptime(LastBootUpTime,"%Y%m%d%H%M%S") 
 | eval secondlastday=relative_time(now(), "-2d@d")
 | eval nexttendays=relative_time(now(), "10d@d") 
 | where (LastLogon < secondlastday) AND (LastBootUpTime > nexttendays)

| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

0 Karma

jip31
Motivator

now i wrothe this :

index="ai-wkst-windows-wmi-fr" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot") 
| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") 
| eval LastBootUpTime = strptime(LastBootUpTime,"%Y%m%d%H%M%S") 
| eval secondlastday=relative_time(now(), "-2d@d") 
| eval nexttendays=relative_time(now(), "+10d@d") 
| where (LastLogon < secondlastday) AND (LastBootUpTime >nexttendays)
| eval LastLogon = strftime(LastLogon,"%d-%m-%Y %H:%M:%S") 
| eval LastBootUpTime = strftime(LastLogon,"%d-%m-%Y %H:%M:%S") 
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host 
| sort -LastLogon

but I think there is an issue in the relative time calculation
for example with | eval secondlastday=relative_time(now(), "-2d@d"), I just want to have the events included between today and 2 days before but i think that with your code I have the events which exists from 2 day before the now() until the end
is it exact??

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...