Getting Data In

Convert AD LDAP Timestamp to Epoch or other readable date

dwithers
Explorer

Using ldapsearch queries in the splunk for windows ifnrastructure app, I am trying to convert the following fields timestamp which is the integer8 windows NT timestamp to epoch or other readable time after my query runs. The timestamp is the number of 100-nanoseconds intervals (1 nanosecond = one billionth of a second) since Jan 1, 1601 UTC

Anyone have any experience with this? Would be much appreciated!

field = msDS-LastSuccessfulInteractiveLogonTime
timestamp returned = 129878945338632316

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi dwithers,

take this run everywhere example and adapt it to your needs:

index=_internal | head 1 | eval AD_time="129878945338632316" 
| eval myTime=AD_time/1000000000 
| eval myNiceTime=strftime(myTime, "%F %H:%M:%S.%3Q") 
| table myNiceTime

the first line is only to setup the AD like time field, the second eval will 'convert' it into epoch time and the last eval will create a nice human readable time stamp out of it.

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi dwithers,

take this run everywhere example and adapt it to your needs:

index=_internal | head 1 | eval AD_time="129878945338632316" 
| eval myTime=AD_time/1000000000 
| eval myNiceTime=strftime(myTime, "%F %H:%M:%S.%3Q") 
| table myNiceTime

the first line is only to setup the AD like time field, the second eval will 'convert' it into epoch time and the last eval will create a nice human readable time stamp out of it.

cheers, MuS

dwithers
Explorer

eval myTime=AD_time/10000000 - 11644473600

got it. Thanks for your help!

0 Karma

dwithers
Explorer

he current LDAP time = (time()+11644473600)*10000000;
You can replace time() with any UNIX timestamp or strtotime("15 November 2012") is the math if ound around it

0 Karma

dwithers
Explorer

Actually, i just found it's 64bit in of the number of 100 nanoseconds since 1/1/1601

0 Karma

MuS
SplunkTrust
SplunkTrust

small update: are you sure these are nano seconds? Looks like there is one number missing in your example....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...