How to write a search using an eval object with a wildcard?

sfellin — Tue, 29 Sep 2020 09:30:33 GMT

I am trying to use an eval object as the basis of a search pattern along with a wildcard and Splunk is not happy with my efforts.

I have a field (DATE_FIELD) with data such as 20160419_003425 and I'm trying to collect all of the current day's events only:

create a variable with today's date > search against a field using variable + wildcard

Tried:
index=myIndex | eval now=now(), today=strftime(now(), "%Y%m%d") | search DATE_FIELD = `today`* >> throws error
index=myIndex | eval now=now(), today=strftime(now(), "%Y%m%d") | search DATE_FIELD = today*
index=myIndex | eval now=now(), today=strftime(now(), "%Y%m%d") | where DATE_FIELD = `today`*
index=myIndex | eval now=now(), today=strftime(now(), "%Y%m%d") | where DATE_FIELD = today*
index=myIndex | eval now=now(), today=strftime(now(), "%Y%m%d") | where like(DATE_FIELD, "today%")

Feel like there's an obvious way to accomplish this, but haven't located it yet; requirement is current day (and current day only). Of course, enjoy the simpler solution rather than over-engineering (sure I could make a three-line regex...)

Re: How to write a search using an eval object with a wildcard?

somesoni2 — Tue, 19 Apr 2016 16:28:03 GMT

Try like this

index=myindex | where LIKE(DATE_FIELD,strftime(now(), "%Y%m%d") ."_%")

index=myindex | where match(DATE_FIELD,strftime(now(), "%Y%m%d") ."_.*")

Re: How to write a search using an eval object with a wildcard?

sfellin — Tue, 19 Apr 2016 16:38:59 GMT

Thanks; I used a regex on the field to capture the first 8 digits to compare it to the eval but this is a cleaner approach -- switched!

topic Re: How to write a search using an eval object with a wildcard? in Splunk Search

How to write a search using an eval object with a wildcard?

Re: How to write a search using an eval object with a wildcard?

Re: How to write a search using an eval object with a wildcard?