Splunk Search

Creating a table that includes a column for date/time of an event

Kuronoa
New Member

Hello! I'll try to keep things as brief and concise as I can, but what you need to know is that I'm currently building a dashboard that tracks various criteria of windows machines, and depending on the conditions of these criteria, a score is assigned to each category, and when a specific host reaches a high enough score, it is considered for decommission.

One of the criteria involved with determining the scoring for whether or the likelihood of a host needing decommission is how long ago somehow has logged into said host.

I was wondering if anyone had any suggestions as to run a search and use eval to add a column containing the recorded time each windows event was received 

below is an example of what one of the splunk events looks like using our index

Kuronoa_0-1622686499242.png

And here is a mockup designed to help better explain what I'm trying to do here:

Kuronoa_1-1622686751735.png

 

Thanks for taking the time to read my question!

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval dayssincelastlogin=(relative_time(now(),"@d")-strptime(lastlogindate,"%m/%d/%Y"))/(60*60*24)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...