Alerting

How to convert the date format in splunk to create alert based on expiry date?

ashanka
Explorer

Hi

I have date format in logs as below.

Expiry date : Sun Apr 11 05:00:00 MST 2021

I need to create an alert if the expiry date less than 90 days from today.

This is what I tried with no luck. Can anyone help?

ns=application_logs "Cert DN = CN=E3.certificate"   
| table Number, Cert DN, Expiry Date
| dedup Number, Cert DN, Expiry Date
| eval dateDue=strptime('Days_to_Expire', "%Y-%m-%d %H:%M:%S.%6N")
| eval days = round((now()-dateDue)/86400)
| table Number, DN,Date,Days_to_Expire
0 Karma
1 Solution

Vijeta
Influencer

@ashanka you can use this format to get timestamp

eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")

View solution in original post

0 Karma

ashanka
Explorer

do we have an option of creating an alert for days <= 90 and days <= 60 in a single serach in splunk. or it has to be a separate alert?

0 Karma

Vijeta
Influencer

@ashanka you can use this format to get timestamp

eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")
0 Karma

ashanka
Explorer

That worked, How can i do dateDue - today date.

I will have to send alert if dateDue is less than 90 days

0 Karma

ashanka
Explorer

Thanks Vijeta.. It worked

0 Karma

Vijeta
Influencer

@ashanka

  ns=application_logs "Cert DN = CN=E3.certificate"   
     | table Number, Cert DN, Expiry Date
     | dedup Number, Cert DN, Expiry Date
     |eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")
     | eval days = round((dateDue-now())/86400) | where days <= 90
     | table Number, DN,Date,Days_to_Expire 
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...