https://community.splunk.com/t5/Splunk-Search/Use-parametric-time-variable-in-source-name/m-p/565080#M196853 <P>Rather than setting the lookup name in an eval, use a subsearch.&nbsp; Try this query.</P><LI-CODE lang="markup">| set diff [ | search index=myindex [ | makeresults | eval source=strftime(now(),"*%Y-%m-%d*.csv") | return source ] | stats count by idx | table idx] [ search index=myindex source="*2021-08-25*.csv" | stats count by idx | table idx] | join idx [ search index=myindex [ | makeresults | eval source=strftime(now(),"*%Y-%m-%d*.csv") | return source ] ] | table "SITE ID",idx,"Title",FQDN,"Asset Primary Identifier","IP Address",Hostname,"Operating System", Port</LI-CODE><P>&nbsp;</P> Fri, 27 Aug 2021 16:49:43 GMT richgalloway 2021-08-27T16:49:43Z https://community.splunk.com/t5/Splunk-Search/Use-parametric-time-variable-in-source-name/m-p/565070#M196847 <P>Hello to everybody,</P><P>we are trying to set a search that makes a diff between two files of two different days. This is the working search:</P><P>&nbsp;</P><LI-CODE lang="markup">| set diff [| search index=myindex source="*2021-08-27*.csv" | stats count by idx | table idx] [ search index=myindex source="*2021-08-26*.csv" | stats count by idx | table idx] | join idx [ search index=myindex source="*2021-08-27*.csv"] | table "SITE ID",idx,"Title",FQDN,"Asset Primary Identifier","IP Address",Hostname,"Operating System", Port</LI-CODE><P>&nbsp;</P><P><BR />However, we'd like to make it parametric, we'd like dates contained in source names are calculated automatically, so we tried to insert this:</P><P>&nbsp;</P><LI-CODE lang="markup">| set diff [ | eval todayFile=strftime(now(),"*%Y-%m-%d*.csv") | search index=myindex source=todayFile | stats count by idx | table idx] [ search index=myindex source="*2021-08-25*.csv" | stats count by idx | table idx] | join idx [ search index=myindex source=todayFile] | table "SITE ID",idx,"Title",FQDN,"Asset Primary Identifier","IP Address",Hostname,"Operating System", Port</LI-CODE><P>&nbsp;</P><P>but it's not working, or, better, it doesn't return errors but it doesn't return correct results either.</P><P>How can we substitute&nbsp;source="*2021-08-25*.csv" with an instruction that dynamically inserts today date in our source filename in order to run the search every day?</P> Fri, 27 Aug 2021 14:05:07 GMT https://community.splunk.com/t5/Splunk-Search/Use-parametric-time-variable-in-source-name/m-p/565070#M196847 nicofantinato 2021-08-27T14:05:07Z https://community.splunk.com/t5/Splunk-Search/Use-parametric-time-variable-in-source-name/m-p/565080#M196853 <P>Rather than setting the lookup name in an eval, use a subsearch.&nbsp; Try this query.</P><LI-CODE lang="markup">| set diff [ | search index=myindex [ | makeresults | eval source=strftime(now(),"*%Y-%m-%d*.csv") | return source ] | stats count by idx | table idx] [ search index=myindex source="*2021-08-25*.csv" | stats count by idx | table idx] | join idx [ search index=myindex [ | makeresults | eval source=strftime(now(),"*%Y-%m-%d*.csv") | return source ] ] | table "SITE ID",idx,"Title",FQDN,"Asset Primary Identifier","IP Address",Hostname,"Operating System", Port</LI-CODE><P>&nbsp;</P> Fri, 27 Aug 2021 16:49:43 GMT https://community.splunk.com/t5/Splunk-Search/Use-parametric-time-variable-in-source-name/m-p/565080#M196853 richgalloway 2021-08-27T16:49:43Z https://community.splunk.com/t5/Splunk-Search/Use-parametric-time-variable-in-source-name/m-p/565277#M196942 <P>It works!</P><P>Many thanks</P> Tue, 31 Aug 2021 06:36:12 GMT https://community.splunk.com/t5/Splunk-Search/Use-parametric-time-variable-in-source-name/m-p/565277#M196942 nicofantinato 2021-08-31T06:36:12Z