I can't seem to convert epoch time when using timechart. I'm trying to get each users first logon of the day over a period of time. Here's my search:
sourcetype="wineventlog:security" NOT Account_Name="*$" EventCode=4624 | timechart span=1d min(_time) as FirstLogon by user | convert ctime(FirstLogon)
I could use a fresh set of eyes on this. Any help would be appreciated!
Try this
sourcetype="wineventlog:security" NOT Account_Name="*$" EventCode=4624| eval FirstLogon=strftime(_time, "%m/%d/%y %H:%M:%S")| timechart span=5m last(FirstLogon) as FirstLogon by user
Try this
sourcetype="wineventlog:security" NOT Account_Name="*$" EventCode=4624| eval FirstLogon=strftime(_time, "%m/%d/%y %H:%M:%S")| timechart span=5m last(FirstLogon) as FirstLogon by user
My bad, I overlooked it. Will update the answer.
Thank you. Got it working, but had to use 'last(FirstLogon)' instead of 'first(FirstLogon)' since first was pulling the latest logon of the day.
I'm using 6.0
which version of splunk are you using?