System login after hours

[essibong1]

Hello,
I had requested help with a "search language that could determine system logins after core hours" and one of the nice people here puts the below search together for me. does this search need any revisions or is it incomplete? if it does need some revisions can anyone help with such revisions please?

[out_working_time]
definition = | eval day=strftime(_time,"%d/%m/%Y")\
| lookup SIEMCAL.csv day OUTPUT type\
| search Tipo=2 OR (Tipo=1 (date_hour>14 OR (date_hour<7 AND date_minute<45))) OR (Tipo=0 (date_hour>20 OR (date_hour<8 AND date_minute<45)))
iseval = 0

[gcusello]

Hi @essibong1,
sorry, probably I wasn't so clear in my previous answer!

this is a macro definition that I hinted in my answer to your previous question ( https://answers.splunk.com/answers/789359/can-any-one-provide-me-with-a-good-search-to-monit.html#an... 😞 I used a macro to have in only one point the working time definition so I can modify it in only one point instead in each search of my app.

Anyway, if you don't want to use a macro, you have to create your search starting from the filter for the access events (e.g. in windows EventCode=4624) and then filter for the hours and minutes.

The other needed information is if you want only to filter for time or you want also to filter for holydays:

if you want to filter only for time, you can run something like this (working time 8.00 - 17.00):

index=your_index EventCode=4624 (date_hour<8 OR date_hour>18)
| ...

If instead you want also holydays (using the lookup), you have to create a lookup (called e.g. SIEMCAL.csv) containing two information:

• day in a format you like (e.g. dd/mm/yyyy),
• type (0 for working time, 1 for half working time, 2 for holydays).

So for windows systems you can run something like this:

index=your_index EventCode=4624 
| eval day=strftime(_time,"%d/%m/%Y")
| lookup SIEMCAL.csv day OUTPUT type
| search type=2 OR (Tipo=1 (date_hour>14 OR (date_hour<8)) OR (type=0 (date_hour>18 OR date_hour<8)))
| ...

Ciao.
Giuseppe

[FrankVl]

That's not a search, it is a macro.

Maybe easier to just continue in the original question: https://answers.splunk.com/answers/789359/can-any-one-provide-me-with-a-good-search-to-monit.html

As I mentioned there, there are some serious caveats with that macro, so I'd not recommend using it like that. Especially if you apparently don't understand what it does.

There were some good comments and questions on your previous post. I'd start with looking at those and responding to the clarification questions that were asked there. Otherwise it is not really possible to provide a lot of help.

[richgalloway]

That doesn't look like a search. It looks like a macro definition.
Your best option is to ask the person who gave you the information.