How to convert Windows lastLogonTimestamp from this format 07:17.45 PM, Fri 09/30/2022 to 09/30/2022 19:17:45
Thank you
Hi @hank72,
sorry, my error:
| eval lastLogonTimestamp=strftime(strptime(lastLogonTimestamp,"%I:%M.%S %p, %a %m/%d/%Y"),"%m/%d/%Y %H:%M:%S")
Ciao.
Giuseppe
Hi @hank72,
to convert a date, you have to transform it in epochtime (using strptime) and then again the output format (using strftime) in an eval command, something like this:
| eval lastLogonTimestamp=strftime(strptime(lastLogonTimestamp,"%H:%M.%S %p, %a %m/%d/%Y"),"%m/%d/%Y %H:%M:%S")
for more infos see at
Ciao.
Giuseppe
Thank you Giuseppe, however my time is still showing up as 07:17:45 and not as 19:17:45
Hi @hank72,
sorry, my error:
| eval lastLogonTimestamp=strftime(strptime(lastLogonTimestamp,"%I:%M.%S %p, %a %m/%d/%Y"),"%m/%d/%Y %H:%M:%S")
Ciao.
Giuseppe
Thank you! It worked!
Hi @hank72,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉