Alerting

How to convert the date format in splunk to create alert based on expiry date?

ashanka
Explorer

Hi

I have date format in logs as below.

Expiry date : Sun Apr 11 05:00:00 MST 2021

I need to create an alert if the expiry date less than 90 days from today.

This is what I tried with no luck. Can anyone help?

ns=application_logs "Cert DN = CN=E3.certificate"   
| table Number, Cert DN, Expiry Date
| dedup Number, Cert DN, Expiry Date
| eval dateDue=strptime('Days_to_Expire', "%Y-%m-%d %H:%M:%S.%6N")
| eval days = round((now()-dateDue)/86400)
| table Number, DN,Date,Days_to_Expire
0 Karma
1 Solution

Vijeta
Influencer

@ashanka you can use this format to get timestamp

eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")

View solution in original post

0 Karma

ashanka
Explorer

do we have an option of creating an alert for days <= 90 and days <= 60 in a single serach in splunk. or it has to be a separate alert?

0 Karma

Vijeta
Influencer

@ashanka you can use this format to get timestamp

eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")
0 Karma

ashanka
Explorer

That worked, How can i do dateDue - today date.

I will have to send alert if dateDue is less than 90 days

0 Karma

ashanka
Explorer

Thanks Vijeta.. It worked

0 Karma

Vijeta
Influencer

@ashanka

  ns=application_logs "Cert DN = CN=E3.certificate"   
     | table Number, Cert DN, Expiry Date
     | dedup Number, Cert DN, Expiry Date
     |eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")
     | eval days = round((dateDue-now())/86400) | where days <= 90
     | table Number, DN,Date,Days_to_Expire 
0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...