How to search in active directory for servers connected in the last 14 days?

[numeroinconnu12]

Hello and happy new year to all,

As the title says I would like to have the list of servers that have connected over the last 14 days (Lastlogon)... I have tried several methods but nothing works, here is my query : 

index=msad  SamAccountName=*$ VersionOS="Windows Server*"
| eval llt=strptime(LastLogon,"%d/%m/%Y %H:%M:%S")
| eval LastLogon2=strftime(llt, "%d/%m/%Y %H:%M:%S")
| rex field=SamAccountName mode=sed "s/\$//g"
| table Domain,SamAccountName,VersionOS,LastLogon2

Thanks 

[numeroinconnu12]

thank you very much, it's works@richgalloway

[richgalloway · Accepted solution]

You created the llt field, but didn't do anything with it.  Use the relative_time function to see how old llt is.

index=msad  SamAccountName=*$ VersionOS="Windows Server*"
| eval llt=strptime(LastLogon,"%d/%m/%Y %H:%M:%S")
| where llt > relative_time(now(), "-14d")
| rex field=SamAccountName mode=sed "s/\$//g"
| table Domain,SamAccountName,VersionOS,LastLogon