Splunk Search

How to search for duration between events?

julian0125
Explorer

Hello, Splunkers friends,

I need your support; I have a script running on Splunk once at a day, it brings me password last update information on the servers, for example: "Thu Jun 20 17:52:55 2019".
What I need to know is calculation the days that have passed since the last password change,
for example: "this user has not changed the password for the last 7 days, 6 days, 1 day" etc, like a traffic light.
Is there a way to calculate that on a search having this information?

Thanks!!

Tags (2)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @julian0125,

Yeap, totally possible. Try this search :

| makeresults 
| eval timeField="Thu Jun 20 17:52:55 2019" 
| eval epochTimeField=strptime(timeField, "%c") 
| eval timeNow=now() 
| eval TimeSincePasswordChangeInSeconds=tostring(timeNow-epochTimeField,"duration")

Hope that helps.

Cheers,
David

View solution in original post

0 Karma

woodcock
Esteemed Legend

This will need some adjustment

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| rex "(?<TimeLastUpdatePW>\w{3}\s\w{3}\s\d+\s\d+:\d+:\d+\s=d{4})"
| eval TimeLastUpdatePW=strptime(TimeLastUpdatePW, "%a %b %d %H:%M:%S %Y")
| eval ago = TimeLastUpdatePW - now()
| eval ago = tostring(ago, "duration")
| eval Message = "This user has not changed the password for the last " . ago
| table Message
0 Karma

DavidHourani
Super Champion

Hi @julian0125,

Yeap, totally possible. Try this search :

| makeresults 
| eval timeField="Thu Jun 20 17:52:55 2019" 
| eval epochTimeField=strptime(timeField, "%c") 
| eval timeNow=now() 
| eval TimeSincePasswordChangeInSeconds=tostring(timeNow-epochTimeField,"duration")

Hope that helps.

Cheers,
David

0 Karma

julian0125
Explorer

Hi @DavidHourani

Hi, Thanks for your help, i have a field named: "Last_Update" where i recieved all info date like: "Thu Jun 20 17:52:55 2019", is there a way to do it automatically insted of putting manually the date? to know all of them

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Try below search

<yourBaseSearch>
| eval diff=tostring(now() - strptime(<yourDateTimefield>, "%a %b %d %H:%M:%S %Y"), "duration")

Below is run anywhere search

| makeresults
| eval date="Thu Jun 20 17:52:55 2019"
| eval diff=tostring(now() - strptime(date, "%a %b %d %H:%M:%S %Y"), "duration")
0 Karma

julian0125
Explorer

Hi, Thanks for your help, i have a field named: "Last_Update" where i recieved all info date, is there a way to do it automatically insted of putting manually the date: "Thu Jun 20 17:52:55 2019"

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

so your search will be

  <yourBaseSearch>
 | eval diff=tostring(now() - strptime(Last_Update, "%a %b %d %H:%M:%S %Y"), "duration")
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...