1. Prerequisites

Before pushing the app to a Universal Forwarder (UF) using a Deployment Server (DS) or installing it manually, ensure that the following index is created on the indexer:

Index: certexpirymonitor

2. Configuration

splunkforwarderpath.conf

If Splunk Forwarder is installed in the /opt/ directory, no additional configuration is required. However, if it is installed in a different directory, create a local splunkforwarderpath.conf file and specify the full path of the certificate files.

Default Configuration (default/splunkforwarderpath.conf):

3. inputs.conf

To check certificate expiry dates, enable the appropriate script inputs in inputs.conf based on the certificates

4. Splunk Search Query for Expiry Monitoring

After enabling the inputs, use the following SPL query to monitor certificate expiry:

index="certexpirymonitor"

| dedup hostname certpath

| eval expiryepoch=strptime(expirydate, "%b %d %H:%M:%S %Y GMT")

| eval daysleft = round((expiryepoch - now()) / 86400, 2)

| table _time hostname certpath expirydate daysleft

| sort days_left

5. Deployment Considerations

When pushing this app through the Deployment Server, enable the 'restart Splunk Forwarder' option to ensure the inputs start running.

Platform Compatibility

This app is currently designed for Linux Universal Forwarders (UF) only.

Support for Windows Universal Forwarders will be added in a later version.

6. Notes

Ensure that the appropriate scripts are enabled in inputs.conf for monitoring.

Modify splunkforwarderpath.conf only if Splunk is not installed in /opt/.

Restart Splunk after installing the app to apply changes.

The inputs will only run after restarting the Splunk Forwarder.

Certificate Expiry Monitor

0