Another time/date/string query

[willadams]

Hi All,

I am recently new to SPLUNK and trying to identify a way of doing some time differences. I have done an export for the enabled devices in AD and their last logon times. An example of a result is

HOSTNUMBER1,HOSTNUMBER1.domain.com,Windows Server 2008, 26/10/2017 7:40

From my list I have strung together the following query

index=adlastlogondate AND sourcetype=csv | eval currenttime=strftime(now(),"%d/%m/%Y %H:%M") | eval time=strptime(lastlogondate,"%d/%m/%Y %H:%M") eval timedifference=lastlogontime-today | table hostname time lastlogondate currenttime timedifference | sort time

This generates the following result (NOTE: using "|" to denote columns in the table). Note I get no time difference (which is likely due to this bring a string)

---

Hostname | time | lastlogondate | currenttime | timedifference

HOSTNUMBER1 | 12114214569.000000 | 25/10/2017 01:00 | 26/10/2017 15:16 |

---

I tried running this to convert the string into an epoch time(?) to try this but I get the same result

index=adlastlogondate AND sourcetype=csv | eval currenttime=strftime(now(),"%d/%m/%Y %H:%M") | eval time=strptime(lastlogondate,"%d/%m/%Y %H:%M") | convert ctime(time) AS lastlogontime | convert ctime(currenttime) AS today |eval timedifference=lastlogontime-today | table hostname time lastlogondate currenttime timedifference | sort time

Where am I going wrong?

[gcusello]

Hi
you don't convert time in human readable but in epochtime using time=strptime(lastlogondate,"%d/%m/%Y %H:%M")
if you want a human readable format you have to use strftime.
Bye.
Giuseppe