Splunk Search

How to create Alert query when date in field is less that 30days?

drogo
Explorer

Hi Team,

I am setting up an alert on Splunk where my data is in below format.  I am writing a query where it returns those row only where CertExpiry is in15 days.
Basically alert should trigger if cert is getting expired in next 15days.

Component  Server CertExpiry
Zone.jar sample September 13, 2023 9:49:49 AM CDT

 

Labels (1)
Tags (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @drogo,

I suppose that you have these fields from a search.

You have to set up a condition that CertExpiry -now() is less than 15 days, something like this:

<your_search>
| stats latest(CertExpiry) AS CertExpiry BY Server Component
| eval CertExpiry=strptime(CertExpiry,"%B %d,%Y %I:%M:%S %p %Z")
| where CertExpiry>now()-1296000

Adapt the control logic to you use case.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...