Splunk Search

UNIX time for the first day of the month of last month

jacortijo
Explorer

I am querying Nessus imported data and I would like to find old vulnerabilities still present today.
More precisely, events where the publication patch date (patchPubDate in UNIX time) is older than the first day of last month.

Example:     today is 9/11/2020 , so I would like to get the events older than 1/10/2020

I tried the query below but it gives 0 results which it is not possible because, unfortunately, I know I have dozens. So the query must be wrong somehow.  

note: last_found is when the vulnerability was seen for last time in UNIX time.

 

index=nessus sourcetype="tenable:sc:vuln" patchPubDate!=-1
| eval today = round(relative_time(now(), "-0d@d"))
| eval month = strftime(patchPubDate,"%m")
| eval lastmonth = month - 1
| eval year = strftime(patchPubDate,"%Y")
| eval dateLastMonth = "1/".lastmonth."/".year
| eval dateLastMonthUnix = strptime(dateLastMonth, "%d/%m/%Y")
| where last_found >= today AND pathPubDate<dateLastMonthUnix

 

 

 

 

any suggestion?

many thanks.

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There is a simpler way to get the first day of last month.  Use relative_time().

index=nessus sourcetype="tenable:sc:vuln" patchPubDate!=-1
| eval today = relative_time(now(), "-0d@d")
| eval dateLastMonthUnix=relative_time(now(), "-1mon@mon")
| where last_found >= today AND pathPubDate<dateLastMonthUnix
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

somesoni2
Revered Legend

Are you sure? The relative_time syntax and value should work fine. 

Try running this run-anywhere search:

 

| makeresults | eval today=strftime( _time,"%F %T") | eval firstOfLastMonth=strftime( relative_time(_time,"-1mon@mon") ,"%F %T")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is a simpler way to get the first day of last month.  Use relative_time().

index=nessus sourcetype="tenable:sc:vuln" patchPubDate!=-1
| eval today = relative_time(now(), "-0d@d")
| eval dateLastMonthUnix=relative_time(now(), "-1mon@mon")
| where last_found >= today AND pathPubDate<dateLastMonthUnix
---
If this reply helps you, Karma would be appreciated.
0 Karma

jacortijo
Explorer

I dont think that relative_time command is giving the date I need.

if today is 9/11, you relative_time command gives 9/10 and I want to get 1/10.

eval dateLastMonthUnix=relative_time(now(), "-1mon@mon")

 

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...