How to convert the date format in splunk to create alert based on expiry date?

[ashanka]

Hi

I have date format in logs as below.

Expiry date : Sun Apr 11 05:00:00 MST 2021

I need to create an alert if the expiry date less than 90 days from today.

This is what I tried with no luck. Can anyone help?

ns=application_logs "Cert DN = CN=E3.certificate"   
| table Number, Cert DN, Expiry Date
| dedup Number, Cert DN, Expiry Date
| eval dateDue=strptime('Days_to_Expire', "%Y-%m-%d %H:%M:%S.%6N")
| eval days = round((now()-dateDue)/86400)
| table Number, DN,Date,Days_to_Expire

[ashanka]

do we have an option of creating an alert for days <= 90 and days <= 60 in a single serach in splunk. or it has to be a separate alert?

[Vijeta · Accepted solution]

@ashanka you can use this format to get timestamp

eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")

[ashanka]

That worked, How can i do dateDue - today date.

I will have to send alert if dateDue is less than 90 days

[ashanka]

Thanks Vijeta.. It worked

[Vijeta]

@ashanka

  ns=application_logs "Cert DN = CN=E3.certificate"   
     | table Number, Cert DN, Expiry Date
     | dedup Number, Cert DN, Expiry Date
     |eval dateDue=strptime('Days_to_Expire',"%a %b %d %H:%M:%S %Z %Y")
     | eval days = round((dateDue-now())/86400) | where days <= 90
     | table Number, DN,Date,Days_to_Expire