Splunk Search

How to search for duration between events?

julian0125
Explorer

Hello, Splunkers friends,

I need your support; I have a script running on Splunk once at a day, it brings me password last update information on the servers, for example: "Thu Jun 20 17:52:55 2019".
What I need to know is calculation the days that have passed since the last password change,
for example: "this user has not changed the password for the last 7 days, 6 days, 1 day" etc, like a traffic light.
Is there a way to calculate that on a search having this information?

Thanks!!

Tags (2)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @julian0125,

Yeap, totally possible. Try this search :

| makeresults 
| eval timeField="Thu Jun 20 17:52:55 2019" 
| eval epochTimeField=strptime(timeField, "%c") 
| eval timeNow=now() 
| eval TimeSincePasswordChangeInSeconds=tostring(timeNow-epochTimeField,"duration")

Hope that helps.

Cheers,
David

View solution in original post

0 Karma

woodcock
Esteemed Legend

This will need some adjustment

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| rex "(?<TimeLastUpdatePW>\w{3}\s\w{3}\s\d+\s\d+:\d+:\d+\s=d{4})"
| eval TimeLastUpdatePW=strptime(TimeLastUpdatePW, "%a %b %d %H:%M:%S %Y")
| eval ago = TimeLastUpdatePW - now()
| eval ago = tostring(ago, "duration")
| eval Message = "This user has not changed the password for the last " . ago
| table Message
0 Karma

DavidHourani
Super Champion

Hi @julian0125,

Yeap, totally possible. Try this search :

| makeresults 
| eval timeField="Thu Jun 20 17:52:55 2019" 
| eval epochTimeField=strptime(timeField, "%c") 
| eval timeNow=now() 
| eval TimeSincePasswordChangeInSeconds=tostring(timeNow-epochTimeField,"duration")

Hope that helps.

Cheers,
David

0 Karma

julian0125
Explorer

Hi @DavidHourani

Hi, Thanks for your help, i have a field named: "Last_Update" where i recieved all info date like: "Thu Jun 20 17:52:55 2019", is there a way to do it automatically insted of putting manually the date? to know all of them

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Try below search

<yourBaseSearch>
| eval diff=tostring(now() - strptime(<yourDateTimefield>, "%a %b %d %H:%M:%S %Y"), "duration")

Below is run anywhere search

| makeresults
| eval date="Thu Jun 20 17:52:55 2019"
| eval diff=tostring(now() - strptime(date, "%a %b %d %H:%M:%S %Y"), "duration")
0 Karma

julian0125
Explorer

Hi, Thanks for your help, i have a field named: "Last_Update" where i recieved all info date, is there a way to do it automatically insted of putting manually the date: "Thu Jun 20 17:52:55 2019"

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

so your search will be

  <yourBaseSearch>
 | eval diff=tostring(now() - strptime(Last_Update, "%a %b %d %H:%M:%S %Y"), "duration")
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...