Hi please help here
we are using below base search and we need to see all ssl certificates with days left in EST.
index=ssl_certs |rex field=_raw "[^'\n]*'expires=\"(?<expires>[^\\\'\"]+)"| stats c by host expires cert | eval time = strftime( strptime( expires , "%b %d %H:%M:%S %Y %Z" ), "%Y/%m/%d %H:%M:%S %Z")
need exact query for this we tried a lot actually. we are using ssl_checker app for this.
Based on your search response (which is not a raw data) this could helps you.
index=ssl_certs | rex "expires=\"(?<exp>[^\\\]+)\\\n" | eval expTime = strptime(exp, "%b %d %H:%M:%S %Y %Z"), curTime = now() | eval leftTime = tostring(expTime - curTime, "duration") | eval daysLeft = mvindex(split(leftTime, "+"), 0) | table exp expTime curTime left daysLeft
There are other ways to do it.
Works with me with that app. Can you add that _raw data from your query so we can test it with your data?
index=ssl_certs sourcetype=ssl_certs | head 10 | table _time _raw
Then add that output inside editors </> (code block) so that it will not changed when you are posting it.