Splunk Search

Help creating a search that monitors after hour employee login

New Member

Hello,
I had requested for anyone to provide me with a good search to monitor after hour employee login and I was provided with what doesn't seem to be a search but rather looks like a macro definition as you can see below.

 [out_working_time]
 definition = | eval day=strftime(_time,"%d/%m/%Y")\
 | lookup SIEMCAL.csv day OUTPUT type\
 | search Tipo=2 OR (Tipo=1 (date_hour>14 OR (date_hour<7 AND date_minute<45))) OR (Tipo=0 (date_hour>20 OR (date_hour<8 AND date_minute<45)))
 iseval = 0

Can anyone help me with this search, please?

0 Karma

Builder

If you have the logs of employee login, it should be pretty easy to extract the hour out of the timestamp and run an alert on whatever timeframe (after 5 PM and before 8 AM, or whatever you want) like so:

| makeresults count=3 # in your case this is your base search where you pull in logs
| eval hour=strftime(_time,"%H") # parse out the hour from the _time field
| search hour>17 OR hour < 8 # filter down to just logins after 5 PM or before 8 AM for example

Does this make sense/answer your question?

0 Karma