SSL certificate checker issue: How to see all SSL Certificates in the current search?

[pchintha]

Hi please help here

we are using below base search and we need to see all ssl certificates with days left in EST.

index=ssl_certs |rex field=_raw "[^'\n]*'expires=\"(?<expires>[^\\\'\"]+)"| stats c by host expires cert | eval time = strftime( strptime( expires , "%b %d %H:%M:%S %Y %Z" ), "%Y/%m/%d %H:%M:%S %Z")

need exact query for this we tried a lot actually. we are using ssl_checker app for this.

[isoutamo]

Based on your search response (which is not a raw data) this could helps you.

index=ssl_certs 
| rex "expires=\"(?<exp>[^\\\]+)\\\n"
| eval expTime = strptime(exp, "%b %d %H:%M:%S %Y %Z"), curTime = now()
| eval leftTime = tostring(expTime - curTime, "duration")
| eval daysLeft = mvindex(split(leftTime, "+"), 0)
| table exp expTime curTime left daysLeft

There are other ways to do it.

r. Ismo 

[pchintha]

showing no results

[isoutamo]

Works with me with that app. Can you add that _raw data from your query so we can test it with your data?

e.g.

index=ssl_certs sourcetype=ssl_certs
| head 10
| table _time _raw

Then add that output inside editors </> (code block) so that it will not changed when you are posting it. 

[pchintha]

Here is the sample events

[isoutamo]

Can you post some raw events in code box to helps you?

[pchintha]

This helps for me, from in this and expires is in GMT and the expTime is in EST guess so and we need all to know in EST only