Hi
I have date format in logs as below.
Expiry date : Sun Apr 11 05:00:00 MST 2021
I need to create an alert if the expiry date less than 90 days from today.
This is what I tried with no luck. Can anyone help?
ns=application_logs "Cert DN = CN=E3.certificate"
| table Number, Cert DN, Expiry Date
| dedup Number, Cert DN, Expiry Date
| eval dateDue=strptime('Days_to_Expire', "%Y-%m-%d %H:%M:%S.%6N")
| eval days = round((now()-dateDue)/86400)
| table Number, DN,Date,Days_to_Expire
@ashanka you can use this format to get timestamp
eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")
do we have an option of creating an alert for days <= 90 and days <= 60 in a single serach in splunk. or it has to be a separate alert?
@ashanka you can use this format to get timestamp
eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")
That worked, How can i do dateDue - today date.
I will have to send alert if dateDue is less than 90 days
Thanks Vijeta.. It worked
@ashanka
ns=application_logs "Cert DN = CN=E3.certificate"
| table Number, Cert DN, Expiry Date
| dedup Number, Cert DN, Expiry Date
|eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")
| eval days = round((dateDue-now())/86400) | where days <= 90
| table Number, DN,Date,Days_to_Expire