Splunk Search

How to search for duration between events?

julian0125
Explorer

Hello, Splunkers friends,

I need your support; I have a script running on Splunk once at a day, it brings me password last update information on the servers, for example: "Thu Jun 20 17:52:55 2019".
What I need to know is calculation the days that have passed since the last password change,
for example: "this user has not changed the password for the last 7 days, 6 days, 1 day" etc, like a traffic light.
Is there a way to calculate that on a search having this information?

Thanks!!

Tags (2)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @julian0125,

Yeap, totally possible. Try this search :

| makeresults 
| eval timeField="Thu Jun 20 17:52:55 2019" 
| eval epochTimeField=strptime(timeField, "%c") 
| eval timeNow=now() 
| eval TimeSincePasswordChangeInSeconds=tostring(timeNow-epochTimeField,"duration")

Hope that helps.

Cheers,
David

View solution in original post

0 Karma

woodcock
Esteemed Legend

This will need some adjustment

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| rex "(?<TimeLastUpdatePW>\w{3}\s\w{3}\s\d+\s\d+:\d+:\d+\s=d{4})"
| eval TimeLastUpdatePW=strptime(TimeLastUpdatePW, "%a %b %d %H:%M:%S %Y")
| eval ago = TimeLastUpdatePW - now()
| eval ago = tostring(ago, "duration")
| eval Message = "This user has not changed the password for the last " . ago
| table Message
0 Karma

DavidHourani
Super Champion

Hi @julian0125,

Yeap, totally possible. Try this search :

| makeresults 
| eval timeField="Thu Jun 20 17:52:55 2019" 
| eval epochTimeField=strptime(timeField, "%c") 
| eval timeNow=now() 
| eval TimeSincePasswordChangeInSeconds=tostring(timeNow-epochTimeField,"duration")

Hope that helps.

Cheers,
David

0 Karma

julian0125
Explorer

Hi @DavidHourani

Hi, Thanks for your help, i have a field named: "Last_Update" where i recieved all info date like: "Thu Jun 20 17:52:55 2019", is there a way to do it automatically insted of putting manually the date? to know all of them

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Try below search

<yourBaseSearch>
| eval diff=tostring(now() - strptime(<yourDateTimefield>, "%a %b %d %H:%M:%S %Y"), "duration")

Below is run anywhere search

| makeresults
| eval date="Thu Jun 20 17:52:55 2019"
| eval diff=tostring(now() - strptime(date, "%a %b %d %H:%M:%S %Y"), "duration")
0 Karma

julian0125
Explorer

Hi, Thanks for your help, i have a field named: "Last_Update" where i recieved all info date, is there a way to do it automatically insted of putting manually the date: "Thu Jun 20 17:52:55 2019"

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

so your search will be

  <yourBaseSearch>
 | eval diff=tostring(now() - strptime(Last_Update, "%a %b %d %H:%M:%S %Y"), "duration")
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...