Use Certificate Assist
Certificate Assist gives you insights into the status of the transport layer security (TLS) certificates that you have installed on your Splunk Enterprise instances.
When Certificate Assist loads, the page appears similar to the main Assist page, with indicator severity cards along the top of the page and an overview pane that shows the list of certificates. The name of the pane changes depending on which indicator card you click.
Splunk Assist collects indicators on certificates over a period of the previous 30 days. When you replace your certificates, you might see the old certificates in Certificate Assist for up to 30 days after you have renewed them.
The indicator tabs filter the list of certificates as follows:
- All certificates.: Shows all nodes for which Splunk Assist has recorded certificate information.
- Critical. Shows nodes whose certificates expire within 7 days of the current date, or that have already expired.
- Warning. Shows nodes whose certificates expire within 30 days of the current date.
- Conforming. Shows nodes whose certificates are valid for at least 30 days from the current date.
You can filter nodes by entering text into the "Filter nodes" text box within the overview pane.
To see more information about a node, click the > next to the node. It expands to provide a summary about the node certificate. You can then act on making updates as Certificate Assist advises.
Troubleshoot problems with Certificate Assist
If you encounter problems where Certificate Assist does not display all information about your certificates, reference the following table for common problems and their solutions.
|No certificate indicators appear in the Availability category||
|Only some indexers and forwarders report certificate indicators||
|No certificates appear in the Search tier||Certificate Assist only monitors certificate status on indexers and forwarders. Splunk expects this behavior.|
|Certificate indicators appear to be stale||Splunk Assist logs certificate data every 24 hours from the time that indexers start. If you want to see |
Use App Assist
Use Config Assist
This documentation applies to the following versions of Splunk® Enterprise: 9.0.0, 9.0.1, 9.0.2