https://community.splunk.com/t5/Splunk-Search/How-to-setup-a-query-to-search-and-find-file-names-with-the/m-p/446771#M126711 <P>Like this:</P> <PRE><CODE>index=main sourcetype=files [ |makeresults | eval filename = "email/outlook/" . strftime(now(), "%Y/%m/%d") . "/*" | format ] </CODE></PRE> Fri, 15 Mar 2019 18:04:09 GMT woodcock 2019-03-15T18:04:09Z https://community.splunk.com/t5/Splunk-Search/How-to-setup-a-query-to-search-and-find-file-names-with-the/m-p/446770#M126710 <P>Hi,</P> <P>I have a query that searches a field i.e. filenames with a value in this format &gt;&gt;</P> <PRE><CODE>filename = folder_name/sub_folder_name/date/data for example filename=email/outlook/2019/03/25/outlook-2019-03-15-12:05:00:987Z </CODE></PRE> <P>I am looking to create an alert when the folder is not populated with data, and I want to use a now() or other time variable in the file name.<BR /><BR /> for example </P> <PRE><CODE>index=main sourcetype=files filename=email/outlook/{time variable}/* </CODE></PRE> <P>So if today is 3/15/2019 the current date variable would be 2019/03/15, and tomorrow the query would use 2019/03/16 as the variable...</P> <P>I hope that makes sense. I basically want to search a field using a current date variable...</P> <P>Thanks</P> Fri, 15 Mar 2019 17:46:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-setup-a-query-to-search-and-find-file-names-with-the/m-p/446770#M126710 Log_wrangler 2019-03-15T17:46:29Z https://community.splunk.com/t5/Splunk-Search/How-to-setup-a-query-to-search-and-find-file-names-with-the/m-p/446771#M126711 <P>Like this:</P> <PRE><CODE>index=main sourcetype=files [ |makeresults | eval filename = "email/outlook/" . strftime(now(), "%Y/%m/%d") . "/*" | format ] </CODE></PRE> Fri, 15 Mar 2019 18:04:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-setup-a-query-to-search-and-find-file-names-with-the/m-p/446771#M126711 woodcock 2019-03-15T18:04:09Z