Splunk Search

How do I convert epochtime = -1 to a human readable format?

lball
Explorer

I am creating a dashboard for Tenable results and some entries have a Patch Publication Date value of -1. I'm having trouble getting the search to output results because I can't get the -1 value to resolve to a human readable date. Here is a copy of the search:

index=tenable | eval PatchPubDate=strftime(patchPubDate,"%Y-%m-%d") | stats by riskFactor,severity.id,pluginID,description,solution,pluginText,PatchPubDate,ip

Any ideas of how to get the results to show when the date is -1? When I exclude the -1 values from the search all other epoch time values convert as desired.

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

You could modify the field PatchPubDate before you get to there.

index=tenable 
| eval PatchPubDate=if(PatchPubDate==-1, "1970-07-17", PatchPubDate) 
| eval PatchPubDate=-strftime(patchPubDate,"%Y-%m-%d") 
| stats by riskFactor,severity.id,pluginID,description,solution,pluginText,PatchPubDate,ip

See if that works. It'll make it be my birthday. You can't go much older, because the epoch isn't valid too much earlier than this.

In your display code (e.g. that you don't have here - after all that you could do another eval and if it's 1970-07-17 you could change it to printing out a string like "invalid" if you wanted.)

View solution in original post

0 Karma

petom
Path Finder

Just replace the "invalid" timestamp value with something else. E.g.:

index=tenable 
| eval PatchPubDate=if(patchPubDate=-1, "unknown", strftime(patchPubDate,"%Y-%m-%d")) 
| stats by riskFactor,severity.id,pluginID,description,solution,pluginText,PatchPubDate,ip

or if you still need it to be a timestamp, then:

index=tenable 
| eval PatchPubDate=if(patchPubDate=-1, "1970-01-01", strftime(patchPubDate,"%Y-%m-%d")) 
| stats by riskFactor,severity.id,pluginID,description,solution,pluginText,PatchPubDate,ip
0 Karma

Richfez
SplunkTrust
SplunkTrust

You could modify the field PatchPubDate before you get to there.

index=tenable 
| eval PatchPubDate=if(PatchPubDate==-1, "1970-07-17", PatchPubDate) 
| eval PatchPubDate=-strftime(patchPubDate,"%Y-%m-%d") 
| stats by riskFactor,severity.id,pluginID,description,solution,pluginText,PatchPubDate,ip

See if that works. It'll make it be my birthday. You can't go much older, because the epoch isn't valid too much earlier than this.

In your display code (e.g. that you don't have here - after all that you could do another eval and if it's 1970-07-17 you could change it to printing out a string like "invalid" if you wanted.)

0 Karma

lball
Explorer

It worked!. I did have to convert the date value in line 2 to epochtime to get the final result to figure in correctly, but it worked like a charm otherwise. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...