Please note which scripted input to use, based on the host OS you want to monitor for certificate expirations.
You may enable both inputs and apply to *nix and Windows server classes
TIP: Most Universal Forwarder's have the management port disabled (TCP/8089) so in most cases, deploying this
app to UF's will yield zero results
NOTE: In order for the Windows input to function, Python 3.X needs to be installed as a module available to Powershell
To test, run the command Get-Command Python3 in a Powershell window
# This input is for *nix hosts
[script://./bin/start_linux_check.sh]
interval = 30 1 * * Sun
sourcetype = json_no_timestamp
source = TA_certificate_checker
disabled = 1
# This input is for Windows hosts
[powershell://start_windows_check]
script = . "$SplunkHome\etc\apps\TA_certificate_checker\bin\start_windows_check.ps1"
schedule = 30 1 * * Sun
sourcetype = json_no_timestamp
source = TA_certificate_checker
disabled = 1
index=[user defined] source=TA_certificate_checker sourcetype=json_no_timestamp
| eval expSeconds=(notAfterEpoch - now())
| eval status=if(expSeconds < 0, "Expired", "Valid")
| eval expires=toString(expSeconds, "duration")
| eval expires=if(status = "Expired", -1, expires)
| stats values(host) as "Host", values(CN) as "Common Name", values(expires) as "Expires", by serial, status, service_port
| sort status, expires
System Requirements : Python 3.X or greater
App Developer : Adam Saul
Version Support : app_support@dispatchitsolutions.io
Supports various (apps|peer-apps|slave-apps) directories
Get-Command python3As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.