Splunk Search

How to create Alert query when date in field is less that 30days?

drogo
Explorer

Hi Team,

I am setting up an alert on Splunk where my data is in below format.  I am writing a query where it returns those row only where CertExpiry is in15 days.
Basically alert should trigger if cert is getting expired in next 15days.

Component  Server CertExpiry
Zone.jar sample September 13, 2023 9:49:49 AM CDT

 

Labels (1)
Tags (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @drogo,

I suppose that you have these fields from a search.

You have to set up a condition that CertExpiry -now() is less than 15 days, something like this:

<your_search>
| stats latest(CertExpiry) AS CertExpiry BY Server Component
| eval CertExpiry=strptime(CertExpiry,"%B %d,%Y %I:%M:%S %p %Z")
| where CertExpiry>now()-1296000

Adapt the control logic to you use case.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...