Alerting

How to setup certification expiry alert?

Khanu89
Path Finder

I have a dashboard for all SSL certifications. I'd like to setup few alerts for renewal reminds from Splunk. My current query is as shown below:

Index=epic_ehr source=C:\\logs\certs\\results.json

|Search validdays<60 |table hostname,validddays,issuer,commonName

My custom trigger condition is: search validdays="*" AND count<273

 

When I run this I am seeing results but no alert is triggered nor do I receive any email. please assist

Labels (3)
0 Karma
1 Solution

Khanu89
Path Finder

I was able to self resolve this query! Thanks for taking a look.

View solution in original post

0 Karma

Khanu89
Path Finder

I was able to self resolve this query! Thanks for taking a look.

0 Karma

VatsalJagani
Super Champion

@Khanu89 - Can you please specify the details of fields you have in your data? And also how you are writing the condition you mentioned? What is the count field in the condition?

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...