i have the last sync time for my activesync clients going to splunk via powershell input.
ex: `LastSyncAttemptTime = 04/07/2016 21:49:08`
this produces a text field that is not sortable or useable.
i tried to convert it using:
| eval lastSync=strptime(LastSyncAttemptTime,"%x %T") | table lastSync
with no luck. i have tired numerous variations of %codes to list the date and time, and a few variations produce a decimal value.
my end goal here is to look for clients that last synced over 30 days ago.
any ideas?
thanks
Gd
↧