Splunk Search

strptime to get %Y-%m-%d

chlily
New Member

I run a command as below try to get all the locked out accounts, and get the date like %Y-%m-%d as well. But seems always get numbers.

|ldapsearch domain=default search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" | eval testDate=strptime(lockoutTime,"%Y-%m-%d")|rename sAMAccountName as assoc_user | table assoc_user, lockoutTime, testDate, mail

assoc_user lockoutTime testDate↕ mail↕
s12345 2015-07-28T06:06:55.809482Z 1438005600.000000 abcd@xyz.com

Tags (2)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

Another conversion is needed. strptime converts to the unix epoch, then you need to use strftime to convert it to something readable.

I added more specifiers to the strptime, you may or may not need them (test).

|ldapsearch domain=FCP search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" 
| eval testDate=strptime(lockoutTime,"%Y-%m-%dT%H:%M:%S.%6QZ")
| eval testDate=strftime(testDate,"%Y-%m-%d")
| rename sAMAccountName as assoc_user 
| table assoc_user, lockoutTime, testDate, mail

Give that a try!

View solution in original post

0 Karma

somesoni2
Revered Legend

If from your current query, you're getting epoch value for your testDate, that means the field lockoutTime is already having string format date with the correct date format. You can just drop the strptime all together.

|ldapsearch domain=default search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" | eval testDate=lockoutTime|rename sAMAccountName as assoc_user | table assoc_user, lockoutTime, testDate, mail
0 Karma

Richfez
SplunkTrust
SplunkTrust

Another conversion is needed. strptime converts to the unix epoch, then you need to use strftime to convert it to something readable.

I added more specifiers to the strptime, you may or may not need them (test).

|ldapsearch domain=FCP search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" 
| eval testDate=strptime(lockoutTime,"%Y-%m-%dT%H:%M:%S.%6QZ")
| eval testDate=strftime(testDate,"%Y-%m-%d")
| rename sAMAccountName as assoc_user 
| table assoc_user, lockoutTime, testDate, mail

Give that a try!

0 Karma

chlily
New Member

The command works perfectly. thanks!

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...