topic Re: Specifying today's date in the source file on a search in Splunk Search

Specifying today's date in the source file on a search

DavidGuarneri — Mon, 16 Sep 2013 19:44:55 GMT

Is there a way to specify today's date in the filename of the source on the search? I'm thinking in the same way you would put it in a bash script. Pseudocode:

source="C:logs\\path\\iislog_(time(%y%m%d)).log"

Re: Specifying today's date in the source file on a search

Ayn — Mon, 16 Sep 2013 19:59:07 GMT

Use a subsearch:

[| stats count | eval source="C:\\logs\\path\\iislog".strftime(now(),"%y%m%d").".log" | fields source]

Re: Specifying today's date in the source file on a search

yannK — Mon, 16 Sep 2013 20:03:43 GMT

use the function now() in a subsearch or a macro.

the search to generate a condition :

| stats count | eval date=strftime(now(),"%Y%m%d") | eval source="C:logs\\path\\iislog_".date.".log" | table source

the search using the sub search to generate a source condition

* [ | stats count | eval date=strftime(now(),"%Y%m%d") | eval source="C:logs\\path\\iislog_".date.".log" | table source]

you could improve by using a macro too.

Re: Specifying today's date in the source file on a search

yannK — Mon, 16 Sep 2013 20:04:12 GMT

You are a kung fu master Ayn !

Re: Specifying today's date in the source file on a search

DavidGuarneri — Mon, 16 Sep 2013 20:43:57 GMT

That worked, thank you!