Splunk Enterprise Security

How to find time values that are over 90 days old?

ajdyer2000
Path Finder

Hi,

I have 2 fields I would like to only display **lastLogonTimestamp** values that are over 90 days of the **_time** value

Thanks

lastLogonTimestamp 
 2018-05-30T03:19:45.368884Z    

_time
2018-06-05T15:25:27.999-04:00
0 Karma
1 Solution

kmaron
Motivator
| eval LastLogon=strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%6N") 
| eval LastLogon90days=LastLogon+(90*24*60*60)
| where LastLogon90days < _time

View solution in original post

kmaron
Motivator
| eval LastLogon=strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%6N") 
| eval LastLogon90days=LastLogon+(90*24*60*60)
| where LastLogon90days < _time

ajdyer2000
Path Finder

Thanks kmaron

That works great

Could you do the same for the following?:

I would like to only display TERMINATION_DT values that are over 90 days of the _time value

TERMINATION_DT
2006-03-09 00:00:00.0

_time
2018-06-07T09:09:42.819-04:00

I appreciate this.

Alan

0 Karma

kmaron
Motivator

It's going to be the same thing. The only change is in the format of the strptime (which you can find here: https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Commontimeformatvariables)

 | eval TERMINATION=strptime(TERMINATION_DT,"%Y-%m-%d %H:%M:%S.%N") 
 | eval TERMINATION90days=TERMINATION+(90*24*60*60)
 | where TERMINATION90days < _time
0 Karma

ajdyer2000
Path Finder

Awesome Thanks

0 Karma

pradeepkumarg
Influencer
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...