Azure API credentials Expiring in 6 months

[Kwabena13]

The Credentials used to connect the Splunk TA for Azure was set to expire in 6 months from now. I would like to get an alert created for that in Splunk so we can update this a week before it expires so it does not take us by surprise.

I do not want to set a personal reminder just in case someone else is in the role by then.

Thanks for your help.

[marnall]

You could make a lookup containing the unix time when the API key expires, along with columns describing the key and where to renew it. Then you could make an alert in Splunk that checks if that unix time is X days away

e.g.

| inputlookup when_keys_expire.csv
``` 7*24*60*60 = 1 week worth of seconds ```
| where expirytime > (now() - 7*24*60*60)

The downside to this is that you would have to manually set the lookup table separately when applying a new key.