Splunk Search
Highlighted

How to edit my eval syntax to convert a date from Active Directory to epoch time?

Builder

Hi

How to convert the date format from the active directory to epoch time?

date format:

2016-10-23T05:00:00Z

I tried:

....|eval endDate= strptime(accountExpires,"%Y-%m-%dT%H:%M:%SZ")

but it's not showing anything.

0 Karma
Highlighted

Re: How to edit my eval syntax to convert a date from Active Directory to epoch time?

Legend

Try this

| makeresults | eval accountExpires="2016-10-23T05:00:00Z"|eval endDate= strptime(accountExpires,"%Y-%m-%dT%H:%M:%S")  | eval x=strftime(endDate, "%Y-%m-%dT%H:%M:%S") | table accountExpires endDate x

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.