Splunk Search

Why does my Event show as 2 years delayed?

Fe-atSplunk
Explorer

I am looking for “failed login for ADMIN detected” but because the time in Time is two years late it doesn’t alert.

My log sample is:

FeatSplunk_0-1646818088159.png

I also have _time 2020-02-23T23:02:20.000+01:00

My search so far is:

 

index=abc sourcetype=def "Failed login for ADMIN detected"
| rex field=_raw "(?ms)(?=[^c]*(?:cs2=|c.*cs2=))^(?:[^=\\n]*=){5}(?P<DatabaseEventDate>[^ ]+)"
| stats count by duser cs1 cs2 DatabaseEventDate

 

This gives me a new field with the correct time:

DatabaseEventDate 23.02.2022,13:11:39

 

How can I correct the timestamp without changing the props file (since the basics of the search works for another use case)?

Please help!! Thanks in advance

Labels (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Something like this?

index=abc sourcetype=def "Failed login for ADMIN detected"
| rex field=_raw "(?ms)(?=[^c]*(?:cs2=|c.*cs2=))^(?:[^=\\n]*=){5}(?P<DatabaseEventDate>[^ ]+)"
| eval _time=strptime(DatabaseEventDate,"%d.%m.%Y,%H:%M:%S")
| where _time>relative_time(now(),"-1h")
| rename COMMENT as "Modify above line to appropriate relative_time. Also make sure your searche's timerange is big enough to get to this event"
| stats count by duser cs1 cs2 DatabaseEventDate

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Something like this?

index=abc sourcetype=def "Failed login for ADMIN detected"
| rex field=_raw "(?ms)(?=[^c]*(?:cs2=|c.*cs2=))^(?:[^=\\n]*=){5}(?P<DatabaseEventDate>[^ ]+)"
| eval _time=strptime(DatabaseEventDate,"%d.%m.%Y,%H:%M:%S")
| where _time>relative_time(now(),"-1h")
| rename COMMENT as "Modify above line to appropriate relative_time. Also make sure your searche's timerange is big enough to get to this event"
| stats count by duser cs1 cs2 DatabaseEventDate

Fe-atSplunk
Explorer

-2Y instead of -1h FYI to anybody else, other than that it worked! The timestamp is now showing up correctly. Thank you so much!!

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

If you need to search, using time range, based on DatabaseEventDate values, then you'll have to update your parsing logic to use that timestamp value as _time (https://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition).

If you don't want to change your timestamp parsing, then you'll to modify search similar to this post: https://community.splunk.com/t5/Splunk-Search/How-to-filter-results-based-on-date-not-time/m-p/35317...

0 Karma

Fe-atSplunk
Explorer

I'm trying something simple, so to calculate the lag and add that to the one in the timestamp

| eval time=strftime(_time, "%d/%m/%Y %H:%M")
| eval DatabaseEventDateNew=strftime(DatabaseEventDate, "%d/%m/%Y %H:%M")

doesn't work to start with. I'm happy with an eval command that works

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...