strptime to get %Y-%m-%d

[chlily]

I run a command as below try to get all the locked out accounts, and get the date like %Y-%m-%d as well. But seems always get numbers.

|ldapsearch domain=default search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" | eval testDate=strptime(lockoutTime,"%Y-%m-%d")|rename sAMAccountName as assoc_user | table assoc_user, lockoutTime, testDate, mail

assoc_user lockoutTime testDate↕ mail↕
s12345 2015-07-28T06:06:55.809482Z 1438005600.000000 abcd@xyz.com

[somesoni2]

If from your current query, you're getting epoch value for your testDate, that means the field lockoutTime is already having string format date with the correct date format. You can just drop the strptime all together.

|ldapsearch domain=default search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" | eval testDate=lockoutTime|rename sAMAccountName as assoc_user | table assoc_user, lockoutTime, testDate, mail

[Richfez · Accepted solution]

Another conversion is needed. strptime converts to the unix epoch, then you need to use strftime to convert it to something readable.

I added more specifiers to the strptime, you may or may not need them (test).

|ldapsearch domain=FCP search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" 
| eval testDate=strptime(lockoutTime,"%Y-%m-%dT%H:%M:%S.%6QZ")
| eval testDate=strftime(testDate,"%Y-%m-%d")
| rename sAMAccountName as assoc_user 
| table assoc_user, lockoutTime, testDate, mail

Give that a try!

[chlily]

The command works perfectly. thanks!