Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Splunk Search
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Trouble converting time (epoch) when using tim...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
dpoon
Explorer
02-28-2014
07:54 AM
I can't seem to convert epoch time when using timechart. I'm trying to get each users first logon of the day over a period of time. Here's my search:
sourcetype="wineventlog:security" NOT Account_Name="*$" EventCode=4624 | timechart span=1d min(_time) as FirstLogon by user | convert ctime(FirstLogon)
I could use a fresh set of eyes on this. Any help would be appreciated!
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
somesoni2
Revered Legend
02-28-2014
08:12 AM
Try this
sourcetype="wineventlog:security" NOT Account_Name="*$" EventCode=4624| eval FirstLogon=strftime(_time, "%m/%d/%y %H:%M:%S")| timechart span=5m last(FirstLogon) as FirstLogon by user
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
somesoni2
Revered Legend
02-28-2014
08:12 AM
Try this
sourcetype="wineventlog:security" NOT Account_Name="*$" EventCode=4624| eval FirstLogon=strftime(_time, "%m/%d/%y %H:%M:%S")| timechart span=5m last(FirstLogon) as FirstLogon by user
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
somesoni2
Revered Legend
02-28-2014
08:59 AM
My bad, I overlooked it. Will update the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
dpoon
Explorer
02-28-2014
08:50 AM
Thank you. Got it working, but had to use 'last(FirstLogon)' instead of 'first(FirstLogon)' since first was pulling the latest logon of the day.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
dpoon
Explorer
02-28-2014
08:08 AM
I'm using 6.0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
linu1988
Champion
02-28-2014
08:04 AM
which version of splunk are you using?
Get Updates on the Splunk Community!
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...
Splunk Observability for AI
Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...
🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler
From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0
mTLS wasn’t just a checkbox ...
