About landzaat

landzaat · ‎03-28-2013

Thanks. Never thought strings could be not what they look like. Valuable hint for all coming troubleshoots.

landzaat · ‎03-28-2013

Some Windows events report date/time in zulu format: “‎2013‎-‎03‎-‎27T21:00:32.950000000Z”. I want to convert to epoch. Tried “ eval pt1=strptime(Previous_Time,"%Y-%m-%dT%H:%M:%S.%9NZ") and some variants. Unfortunately no result. I am obviously overlooking something. Who knows what?

landzaat · ‎08-30-2010

Is there a way to show events only if they do not contain a specified field. E.g. 40% of my selected events contain a field named Action. I need to access the 60% of events that do not contain the Action field.

Posts	3
Solutions	0
Karma Given	3
Karma Received	12
Member Since	‎08-30-2010

Online Status	Offline
Date Last Visited	‎01-06-2021 12:18 PM

Convert Zulu time to epoch

Show only events WITHOUT field

Re: Convert Zulu time to epoch

Convert Zulu time to epoch

Show only events WITHOUT field