Splunk Search

How to create Alert query when date in field is less that 30days?

drogo
Explorer

Hi Team,

I am setting up an alert on Splunk where my data is in below format.  I am writing a query where it returns those row only where CertExpiry is in15 days.
Basically alert should trigger if cert is getting expired in next 15days.

Component  Server CertExpiry
Zone.jar sample September 13, 2023 9:49:49 AM CDT

 

Labels (1)
Tags (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @drogo,

I suppose that you have these fields from a search.

You have to set up a condition that CertExpiry -now() is less than 15 days, something like this:

<your_search>
| stats latest(CertExpiry) AS CertExpiry BY Server Component
| eval CertExpiry=strptime(CertExpiry,"%B %d,%Y %I:%M:%S %p %Z")
| where CertExpiry>now()-1296000

Adapt the control logic to you use case.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...