Alerting

How to convert the date format in splunk to create alert based on expiry date?

ashanka
Explorer

Hi

I have date format in logs as below.

Expiry date : Sun Apr 11 05:00:00 MST 2021

I need to create an alert if the expiry date less than 90 days from today.

This is what I tried with no luck. Can anyone help?

ns=application_logs "Cert DN = CN=E3.certificate"   
| table Number, Cert DN, Expiry Date
| dedup Number, Cert DN, Expiry Date
| eval dateDue=strptime('Days_to_Expire', "%Y-%m-%d %H:%M:%S.%6N")
| eval days = round((now()-dateDue)/86400)
| table Number, DN,Date,Days_to_Expire
0 Karma
1 Solution

Vijeta
Influencer

@ashanka you can use this format to get timestamp

eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")

View solution in original post

0 Karma

ashanka
Explorer

do we have an option of creating an alert for days <= 90 and days <= 60 in a single serach in splunk. or it has to be a separate alert?

0 Karma

Vijeta
Influencer

@ashanka you can use this format to get timestamp

eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")
0 Karma

ashanka
Explorer

That worked, How can i do dateDue - today date.

I will have to send alert if dateDue is less than 90 days

0 Karma

ashanka
Explorer

Thanks Vijeta.. It worked

0 Karma

Vijeta
Influencer

@ashanka

  ns=application_logs "Cert DN = CN=E3.certificate"   
     | table Number, Cert DN, Expiry Date
     | dedup Number, Cert DN, Expiry Date
     |eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")
     | eval days = round((dateDue-now())/86400) | where days <= 90
     | table Number, DN,Date,Days_to_Expire 
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...