Hi , source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d"), "%Y-%m-%d %H:%M") |eval CurrentTime=strftime(now(), "%Y-%m-%d %H:%M:%S") |rex field=exp_date "(?\d+):(?\d+)" | rex field=CurrentTime "(?\d+):(?\d+)" | eval in_s = (in_h * 3600) + (in_m * 60) | eval out_s = (out_h * 3600) + (out_m * 60) | eval diff = out_s - in_s | eval tot_h = floor(diff/3600) | eval diff = diff - (tot_h * 3600) | eval tot_m = diff/60 | eval duration = tot_h . ":" . tot_m My output, CurrentTime =2014-10-08 13:48:51 application =TFAYD duration =2:42 exp_date =2014-11-04 11:06 in_h =11 in_m =06 in_s =39960 lastPasswordChange =2014-08-06 11:06:44 out_h =13 out_m =48 out_s =49680 owner =206047117 refreshedDate =2014-10-08 12:19:26 sourcetype =mysql i am able to calculate the hours,minute,seconds , but i want to calculate the days .... in_d is exp_day , out_d is Current Day ... i want to minus Exp_day - Current Day ..????? in_d - out_d how can we calculate the day calculations ??? we are able to get the current day field and exp_day field .... we have to minus exp_day - Current Day ... Thank u , Regards, Siraj ... View more

Hi , source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d"), "%Y-%m-%d %H:%M") |eval compare=strptime(exp_date,"%Y-%m-%d %H:%M:%S") | where compare>now() output, exp_date =2014-11-04 11:06 I am not getting the compare>now() output . exp_date-currentdate(now()) = number of days output .... ????? i am not getting the output .. Thank u ... Regards, Siraj ... View more

Hi , source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d"), "%Y/%m/%d %H:%M") | eval compare=strptime(exp_date,"%Y-%m-%d %H:%M:%S") | where compare>now() I tried this , but iam getting error , No results found like that , if we are trying only exp_date , we are getting the result . | eval compare=strptime(exp_date,"%Y-%m-%d %H:%M:%S") | where compare>now() this is not working .... Thank u 🙂 Regards, Siraj ... View more

Hi , |eval compare=strptime(exp_date,"%Y-%m-%d %H:%M:%S") | where compare>now() I tried this , i am getting no results found error ... Thank u , Regards, Siraj ... View more

Hi , |eval compare=strptime(exp_date,"%Y-%m-%d %H:%M:%S") | where compare>now() I tried this , i am getting no results found error ... Thank u .. Regards, Siraj,Hi , |eval compare=strptime(exp_date,"%Y-%m-%d %H:%M:%S") | where compare>now() I tried this , i am getting no results found error ... ... View more

I am on leave for some three to four days ... I can check this on 8th of this month ... because I am not having server access from here ... form the outside network 🙂 Thanks for a help ... Regards, Siraj ... View more

I am on leave for some three to four days ... I can check this on 8th of this month ... Because I am not having the server access from outside network ... 🙂 Thanks for a help ... ... View more

I am on leave for some three to four days ... I can check this on 8th of this month ... Thanks for a help ... ... View more

http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/convert#Examples dur2sec() Syntax: dur2sec( ) Description: Convert a duration format "D+HH:MM:SS" to seconds. , but here ... we are able to see , it is converting the fields values in to seconds ... ... View more

Hi, dur2sec() Syntax: dur2sec( ) Description: Convert a duration format "D+HH:MM:SS" to seconds. we have to convert this two fields in to seconds , that output have to apply the seconds value in tostring command .... , then we can get the output ... ..... trying to get the output .... as of now i am not getting the results ... Thank u , Regards, Siraj ... View more

Hi , host="sample" | convert dur2sec(Out_Time) dur2sec(In_Time) | eval diff=(Out_Time - In_Time) | eval Newfield=tostring(diff, "duration") | table Newfield this is sample command , |convert dur2sec(exp_date) dur2sec(now()) |eval diff=(exp-date-now()) |eval exp_day=tostring(diff,"duration") i tried this but not getting field output exp_day in output ... is this correct ...? Thank u Regards, Siraj ... View more

Hi, 1.we have a current date , now() 2.we have a expire date . 1. command tostring only gives seconds as output ... example , |eval exp_day=(86400,"duration") it is outputs, exp_day=90+ (90days) exp_day-now() ..... output ... 36+,35+,34+ trying to get the answer ... Thank u , Regards, Siraj ... View more

Hi, source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d@d"), "%Y/%m/%d %H:%M") |rename lastPasswordChange as lastpasswordchangedate | eval DaysToExpire=tostring(strptime(exp_date,"%Y-%m-%d %H:%M:%S")-now(),"duration") in this query , splunk is not accepting the - symbol with command .... example -now() ... Thank u , Regards, Siraj ... View more

Hi somesoni, eval compare=strptime(exp_date,"%Y-%m-%d %H:%M:%S") | where compare>strptime(now(),"%Y-%m-%d %H:%M:%S") I tried this to compare two fields , to get number of day of password expire .... but not getting the result .... Thank u , Regards, Siraj ... View more

Hi somesoni, eval compare=strptime(exp_date,"%Y-%m-%d %H:%M:%S") | where compare>strptime(now(),"%Y-%m-%d %H:%M:%S") I tried this to compare two fields , to get number of day of password expire .... but not getting the result .... Thank u , Regards, Siraj ... View more

i have one sample query , | gentimes start=now() end=exp_date | search starthuman!="Sun*" starthuman!="Sat*" | stats count it can calculate the number of days between exp_date and current date ... but this query is not working ,,,, Thank u , Regards, Siraj ... View more

Hi , source="dmon-tail://idhouse/id_account" application=TFD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d@d"), "%Y/%m/%d %H:%M") This query is working good . I need one more help , I want to count the days between exp_date and today date any one can help me on this ... Thank u , Regards, Siraj ... View more

actually inside of the tostring command we are giving the field value , it can convert to days and hours,minute,seconds , but i think the tostring command need direct input of seconds , then only it can convert it in to days ... exp_day output we have to convert as a seconds, that seconds output we have to submit in tostring command , example , expire_day=tostring(seconds,"duration") seconds we have to calculate for expiry day .. ... View more

Hi, I tried this, i am not getting output for DaysToExpire , Generally In the tostring command , if we are giving the input as a seconds, it is generating the output as or converting to days .... not getting the field of DaysToExpire ... Thank u , Regards, Siraj ... View more

Hi, actually we have a expire date , by using we have to found exp_day , it is expdate-currentdate(now()), it is should in the format of days ... 35days,34days,.... ,source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d@d"), "%Y/%m/%d %H:%M") Exp Day query samples , | convert dur2sec(now()) as reqTimeConverted | convert dur2sec(expdate) as respTimeConverted | eval dur_in_sec=respTimeConverted-reqTimeConverteds |eval newout=tostring(dur_in_sec,"duration") in this query , tostring is not accepting the field values .... it can accept only number in seconds . any one can help me on this ... Thanks u , Regards, Siraj ... View more

Hi , I want to minus this , lastpasswordchangedate =2014-08-06 11:11:43 and exp_date =2014-11-04 00:00:00 , and convert it as a number of days , any one can help me on this ... Thanks u .. Regards, Siraj ... View more

Hi, source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d@d"), "%Y/%m/%d %H:%M") |eval exp_day=exp_date - lastPasswordChange | where exp_date < strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d"),"%Y-%m-%d %H:%M:%S") |rename lastPasswordChange as lastpasswordchangedate , I am trying to get the exp_day , |eval exp_day=exp_date-lastPasswordChange | where exp_date < strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d"),"%Y-%m-%d %H:%M:%S") This exp_day query is correct ? correct me if i am wrong .... i am trying to get the expire day .... 🙂 any can help me on this ... other output is good , other outputs are, application =TFAYD exp_date =2014-11-04 00:00:00 ( it is correct, calculating from lastPasswordChange) lastpasswordchangedate =2014-08-06 11:11:43 owner =501936069 refreshedDate =2014-09-29 09:15:24 sourcetype =mysql Trying to add the field for exp_day ..... 🙂 Thank u ... Regards, Siraj ,source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d@d"), "%Y/%m/%d %H:%M") |eval exp_day=exp_date-lastPasswordChange | where exp_date < strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d"),"%Y-%m-%d %H:%M:%S") |rename lastPasswordChange as lastpasswordchangedate , I am trying to get the exp_day , |eval exp_day=exp_date-lastPasswordChange | where exp_date < strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d"),"%Y-%m-%d %H:%M:%S") This exp_day query is correct ? correct me if i am wrong .... i am trying to get the expire day .... 🙂 any can help me on this ... other output is good , other outputs are, application =TFAYD exp_date =2014-11-04 00:00:00 ( it is correct, calculating from lastPasswordChange) lastpasswordchangedate =2014-08-06 11:11:43 owner =501936069 refreshedDate =2014-09-29 09:15:24 sourcetype =mysql Trying to add the field for exp_day ..... 🙂 Thank u ... Regards, Siraj ... View more

source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d@d"), "%Y/%m/%d %H:%M") |rename lastPasswordChange as lastpasswordchangedate , This query is working good , my output is , application =TFAYD exp_date =2014-11-04 00:00:00 ( it is correct, calculating from lastPasswordChange) lastpasswordchangedate =2014-08-06 11:11:43 owner =501936069 refreshedDate =2014-09-29 09:15:24 sourcetype =mysql it is working good exp_date is working good , i need one more output ... exp_day format , for example 90days,89days,88days password can expire like that .... So expiredays= 90days,89days,88days. we have calculate same this also from lastpassword change date ... please help me on this .... Thank you ... Regards, Siraj, source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d@d"), "%Y/%m/%d %H:%M") |rename lastPasswordChange as lastpasswordchangedate , This query is working good , my output is , application =TFAYD exp_date =2014-11-04 00:00:00 lastpasswordchangedate =2014-08-06 11:11:43 owner =501936069 refreshedDate =2014-09-29 09:15:24 sourcetype =mysql it is working good exp_date is working good , i need one more output ... exp_day format , for example 90days,89days,88days password can expire like that .... So expiredays= 90days,89days,88days. we have calculate same this also from lastpassword change date ... please help me on this .... Thank you ... Regards, Siraj ... View more

Hi , It is working good, Now i am trying to write the output for Expire day . I think it is (lastPasswordChange-exp_date) . exp day is the final output for this query . Thank u , 🙂 Regards, Siraj,Hi , Thank u , it is working good . Now i am trying to write the output for expire day . it is (lastPasswordChange-exp_date) expire day . Thank a lot , Regards, Siraj ... View more