Alerting

How to setup certification expiry alert?

Khanu89
Path Finder

I have a dashboard for all SSL certifications. I'd like to setup few alerts for renewal reminds from Splunk. My current query is as shown below:

Index=epic_ehr source=C:\\logs\certs\\results.json

|Search validdays<60 |table hostname,validddays,issuer,commonName

My custom trigger condition is: search validdays="*" AND count<273

 

When I run this I am seeing results but no alert is triggered nor do I receive any email. please assist

Labels (3)
0 Karma
1 Solution

Khanu89
Path Finder

I was able to self resolve this query! Thanks for taking a look.

View solution in original post

0 Karma

Khanu89
Path Finder

I was able to self resolve this query! Thanks for taking a look.

0 Karma

VatsalJagani
Super Champion

@Khanu89 - Can you please specify the details of fields you have in your data? And also how you are writing the condition you mentioned? What is the count field in the condition?

0 Karma
Get Updates on the Splunk Community!

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...