topic Re: Reading from a specific log file in Splunk Search

Reading from a specific log file

rsmall13 — Mon, 15 Mar 2021 11:13:59 GMT

Hi, I am very new to Splunk. I would like to know how to search just the latest log file from the below screenshot. (i.e. the current days file only)

At the moment I have the below search query , but this is pulling all the files so I'm just not sure how of the syntax for adding the current days date string. Ultimately I am looking to find errors real time which send an alert.

source="d:\\logs\\gmoaisfabricsync\\fabricsyncservice-*.txt"

Cheers,
Rob

Re: Reading from a specific log file

gcusello — Mon, 15 Mar 2021 11:21:31 GMT

Hi @rsmall13,

if every file contains only events of a specific day, you could use your search restricting the time period of your search (e.g. today, or yesterday or the last 24 hours).

Only one hint: use always the index condition to have faster searches.

Ciao.

Giuseppe

Re: Reading from a specific log file

rsmall13 — Mon, 15 Mar 2021 11:46:32 GMT

Ok thanks, that should work! I am also using an index as well.

index="test_apps" AND sourcetype="gao" source="D:\\logs\\GmoAisFabricSync\\FabricSyncService-*.txt"

Re: Reading from a specific log file

gcusello — Mon, 15 Mar 2021 12:01:57 GMT

Hi @rsmall13,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉