I have a CIM compliant log that includes an ssl_end_time which I am having trouble getting splunk to show me only certificates that are due to expire in the next x days. Below is my query. Any suggestions on how I can get the query to show me only certs that are going to expire based on the ssl_end_time, for example, in the next 30 days? index=* tag="certificate" ssl_is_valid!=false ssl_subject!="CN=sa*" | dedup ssl_subject | convert timeformat="%Y/%m/%d" ctime(ssl_end_time) | sort +ssl_end_time | table ssl_start_time ssl_end_time ssl_subject The log I am getting the data from: {timestamp="2020-10-29T04:02:49+13:00" src_host="" transport="" ssl_end_time="1745081196" ssl_engine="" ssl_hash="sha256RSA" ssl_is_valid="False" ssl_issuer="CN=Company Root Certification Authority, DC=company, DC=xx, DC=xx" ssl_serial="0000000000000000" ssl_start_time="04/19/2018 16:36:36" ssl_subject="CN=Company Enterprise Certification Authority, DC=company, DC=xx, DC=xx" ssl_subject_common_name="CN=Company Enterprise Certification Authority, DC=company, DC=xx, DC=xx" store="" logtype="certificate"} thanks for looking ... View more

Hi, I am new to Splunk and I am setting up a dashboard to show when an application pool was last recycled and why. Most of the app pools I am querying have a space in the name (eg, "Process Tracking Service"), so when the query completes, it only shows app pools without a space in the name (eg, "Enrolment"). My query is below: SourceName="Microsoft-Windows-WAS" host="server" | search recycle | rex field=Message "application pool '(? \S*)'" | eval host=upper(host) | eval reason=case(EventCode=5074, "Worker process reached processing time limit", EventCode=5075, "Worker process reached processing request limit", EventCode=5076, "Scheduled recycle", EventCode=5077, "Worker process reached processing virtual memory limit", EventCode=5079, "Manual recycle", EventCode=5080, "Config changes forced recycle", EventCode=5186, "Worker process was shut down due to inactivity") | rename appPool as "App Pool" | table _time host "App Pool" EventCode reason Message | sort by host ... View more