How to create Alert query when date in field is less that 30days?

[drogo]

Hi Team,

I am setting up an alert on Splunk where my data is in below format.  I am writing a query where it returns those row only where CertExpiry is in15 days.
Basically alert should trigger if cert is getting expired in next 15days.

Component	Server	CertExpiry
Zone.jar	sample	September 13, 2023 9:49:49 AM CDT

[gcusello]

Hi @drogo,

I suppose that you have these fields from a search.

You have to set up a condition that CertExpiry -now() is less than 15 days, something like this:

<your_search>
| stats latest(CertExpiry) AS CertExpiry BY Server Component
| eval CertExpiry=strptime(CertExpiry,"%B %d,%Y %I:%M:%S %p %Z")
| where CertExpiry>now()-1296000

Adapt the control logic to you use case.

Ciao.

Giuseppe