How to extract a seconday date/time?

[Stefanie]

I have a scripted input created to monitor certificate expiration.

An example event:

Tue Jul 27 12:07:55 CDT 2021,/opt/splunk/etc/auth/server.pem,notAfter=Nov 29 16:58:08 2023 GMT

Splunk ingests the data using the first timestamp (Tue Jul 27 12:07:55 CDT 2021). Which is not a problem.

I am wanting Splunk to recognize the portion after 'notAfter=' as a second date to where I can sort based upon month, day, and year in order to report when a certificate is nearing expiration.

I have a regular field extraction to include the expiration date in a table, but sorting it only sorts by the first letter of the month.

Is it possible for Splunk to recognize a secondary date/timestamp? Possibly though a regex?

[ITWhisperer]

You would need to parse the time string into an epoch date (number of seconds since the start of 1970)

| eval epoch_expiry=strptime(string_expiry, "%c")

[Stefanie · Accepted solution]

Thanks for your help.

I couldn't get it to work using the command you mentioned, but it sent me in the right direction 🙂

Here's what I had to use.

|eval epoch=strptime(expDate,"%b %d %H:%M:%S %Y") 
|eval certExp=strftime(epoch,"%Y %m %d")
|sort certExp

 The first line got me the epoch time, and then the second line formats the dates to sort my results correctly.

[isoutamo]

And after you have sorted by it you could remove it fields - or use table or fields x,y,z…