I have a scripted input created to monitor certificate expiration.
An example event:
Tue Jul 27 12:07:55 CDT 2021,/opt/splunk/etc/auth/server.pem,notAfter=Nov 29 16:58:08 2023 GMT
Splunk ingests the data using the first timestamp (Tue Jul 27 12:07:55 CDT 2021). Which is not a problem.
I am wanting Splunk to recognize the portion after 'notAfter=' as a second date to where I can sort based upon month, day, and year in order to report when a certificate is nearing expiration.
I have a regular field extraction to include the expiration date in a table, but sorting it only sorts by the first letter of the month.
Is it possible for Splunk to recognize a secondary date/timestamp? Possibly though a regex?
Thanks for your help.
I couldn't get it to work using the command you mentioned, but it sent me in the right direction 🙂
Here's what I had to use.
|eval epoch=strptime(expDate,"%b %d %H:%M:%S %Y")
|eval certExp=strftime(epoch,"%Y %m %d")
|sort certExp
The first line got me the epoch time, and then the second line formats the dates to sort my results correctly.
You would need to parse the time string into an epoch date (number of seconds since the start of 1970)
| eval epoch_expiry=strptime(string_expiry, "%c")
Thanks for your help.
I couldn't get it to work using the command you mentioned, but it sent me in the right direction 🙂
Here's what I had to use.
|eval epoch=strptime(expDate,"%b %d %H:%M:%S %Y")
|eval certExp=strftime(epoch,"%Y %m %d")
|sort certExp
The first line got me the epoch time, and then the second line formats the dates to sort my results correctly.