Alerting

How to setup certification expiry alert?

Khanu89
Path Finder

I have a dashboard for all SSL certifications. I'd like to setup few alerts for renewal reminds from Splunk. My current query is as shown below:

Index=epic_ehr source=C:\\logs\certs\\results.json

|Search validdays<60 |table hostname,validddays,issuer,commonName

My custom trigger condition is: search validdays="*" AND count<273

 

When I run this I am seeing results but no alert is triggered nor do I receive any email. please assist

Labels (3)
0 Karma
1 Solution

Khanu89
Path Finder

I was able to self resolve this query! Thanks for taking a look.

View solution in original post

0 Karma

Khanu89
Path Finder

I was able to self resolve this query! Thanks for taking a look.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Khanu89 - Can you please specify the details of fields you have in your data? And also how you are writing the condition you mentioned? What is the count field in the condition?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...