Hi, I have a sample log like below, for which I have created an alert which triggers if the Expiration Date is greater than current date.
LOGS:
Date : 17/08/2021 12:15:44
Build Number : 3274
Database Date : 2021-07-15
Expiration Date : 2021-08-17
License Expiration Date : 2021-08-17
MY QUERY:
index=myIdx source="/my/logs/catalina.out" linecount=4 | regex _raw = ".*\sExpiration Date\s.*" | rex max_match=0 "^(?<lines>.+)\n+" | eval buildNumber=mvindex(lines,0) | eval expirationDate=mvindex(lines,2) | fields - lines | eval expirationDateVal = mvindex(split(expirationDate,":"),1) | eval buildNumberVal = mvindex(split(buildNumber,":"),1) | eval expiredConvert = strptime(expirationDateVal,"%m-%d-%Y") |eval expiredConvertDiffFormat = strptime(expirationDateVal,"%Y-%m-%d") | eval remDays =round((expiredConvert-now())/86400) | eval remDaysDiffFormat =round((expiredConvertDiffFormat-now())/86400) | where ( remDays <= 15 and remDays != "" ) or ( remDaysDiffFormat !="" and remDaysDiffFormat <= 15 ) | rename remDays as numDays remDaysDiffFormat as numDaysDiffFormat host as host |eval remainingDays =case(numDays!="",numDays,numDaysDiffFormat!="",numDaysDiffFormat)| where remainingDays > 0 | table remainingDays,host,buildNumberVal,expirationDate
Somehow, this query is not pulling up the logs. Is there something which I am missing in my query? The alert should have triggered yesterday. But it hasn't. Kindly help.
Thanks in advance.
