I am trying to create an email notification for users which have a password expiring soon. I then want to include the number of days until it expires. I have the below search. It returns the users which are due to expire. It then emails every user which it returns which has an email address assigned to it in AD. I cannot seem to find a way to include how many days until it expires. | ldapsearch domain=default search="(&(objectclass=user)(!(objectclass=computer)))" attrs="displayName, whenCreated, pwdLastSet, mail" | dedup displayName | eval DateLastChanged=strptime(pwdLastSet, "%Y-%m-%dT%H:%M:%S.%N") | where DateLastChanged < relative_time(now(),"-69d@d") | table DateLastChanged, displayName, mail | outputcsv TempEmailFile.csv | stats values(mail) AS email, values(DateLastChanged) as DateLastChanged | mvexpand email | map search="|inputcsv TempEmailFile.csv | where mail=\"$email$\" | fields - mail | sendemail sendresults=false inline=true server="0.0.0.0" from="senderemail" to=\"$email$\" subject=\"Password Reminder\" message=\"Your password is due to expire in ??? Days.\"" If anyone can think of a way to make it better to make it include the days until it expires, i would be very grateful ... View more

Hello, I am trying to specify a relative time range for a specific field in my search rather than the "_time" field (i.e finding the last 36 hour results on a field called "LogOut"). I cannot just do this "on _time" as I need to create a transaction on some fields, and when searched on _time, it brings results I do not want to see as I have keepevicted results on. Thanks ... View more

I currently have a Remote File & Directory Data Input on the following log ' C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx ' If I disable and enable the Data Input, it will import the log data. If I then go and make events within the log, it does not automatically import in to Splunk. However, if i go back and disable and enable the Data Input, it will import the backlog of events perfectly. Is there any way to automate this? ... View more