Splunk Search

strptime to get %Y-%m-%d

chlily
New Member

I run a command as below try to get all the locked out accounts, and get the date like %Y-%m-%d as well. But seems always get numbers.

|ldapsearch domain=default search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" | eval testDate=strptime(lockoutTime,"%Y-%m-%d")|rename sAMAccountName as assoc_user | table assoc_user, lockoutTime, testDate, mail

assoc_user lockoutTime testDate↕ mail↕
s12345 2015-07-28T06:06:55.809482Z 1438005600.000000 abcd@xyz.com

Tags (2)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

Another conversion is needed. strptime converts to the unix epoch, then you need to use strftime to convert it to something readable.

I added more specifiers to the strptime, you may or may not need them (test).

|ldapsearch domain=FCP search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" 
| eval testDate=strptime(lockoutTime,"%Y-%m-%dT%H:%M:%S.%6QZ")
| eval testDate=strftime(testDate,"%Y-%m-%d")
| rename sAMAccountName as assoc_user 
| table assoc_user, lockoutTime, testDate, mail

Give that a try!

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If from your current query, you're getting epoch value for your testDate, that means the field lockoutTime is already having string format date with the correct date format. You can just drop the strptime all together.

|ldapsearch domain=default search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" | eval testDate=lockoutTime|rename sAMAccountName as assoc_user | table assoc_user, lockoutTime, testDate, mail
0 Karma

Richfez
SplunkTrust
SplunkTrust

Another conversion is needed. strptime converts to the unix epoch, then you need to use strftime to convert it to something readable.

I added more specifiers to the strptime, you may or may not need them (test).

|ldapsearch domain=FCP search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" 
| eval testDate=strptime(lockoutTime,"%Y-%m-%dT%H:%M:%S.%6QZ")
| eval testDate=strftime(testDate,"%Y-%m-%d")
| rename sAMAccountName as assoc_user 
| table assoc_user, lockoutTime, testDate, mail

Give that a try!

0 Karma

chlily
New Member

The command works perfectly. thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...