Splunk Enterprise Security

How to find time values that are over 90 days old?

ajdyer2000
Path Finder

Hi,

I have 2 fields I would like to only display **lastLogonTimestamp** values that are over 90 days of the **_time** value

Thanks

lastLogonTimestamp 
 2018-05-30T03:19:45.368884Z    

_time
2018-06-05T15:25:27.999-04:00
0 Karma
1 Solution

kmaron
Motivator
| eval LastLogon=strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%6N") 
| eval LastLogon90days=LastLogon+(90*24*60*60)
| where LastLogon90days < _time

View solution in original post

kmaron
Motivator
| eval LastLogon=strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%6N") 
| eval LastLogon90days=LastLogon+(90*24*60*60)
| where LastLogon90days < _time

ajdyer2000
Path Finder

Thanks kmaron

That works great

Could you do the same for the following?:

I would like to only display TERMINATION_DT values that are over 90 days of the _time value

TERMINATION_DT
2006-03-09 00:00:00.0

_time
2018-06-07T09:09:42.819-04:00

I appreciate this.

Alan

0 Karma

kmaron
Motivator

It's going to be the same thing. The only change is in the format of the strptime (which you can find here: https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Commontimeformatvariables)

 | eval TERMINATION=strptime(TERMINATION_DT,"%Y-%m-%d %H:%M:%S.%N") 
 | eval TERMINATION90days=TERMINATION+(90*24*60*60)
 | where TERMINATION90days < _time
0 Karma

ajdyer2000
Path Finder

Awesome Thanks

0 Karma

pradeepkumarg
Influencer
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...