topic Regex for changing date in Splunk Search

Regex for changing date

aniketb — Thu, 03 Mar 2016 20:46:02 GMT

Hi,

I want to check daily if my file generated successfully. The filename is prefixed by date so e.g.

3 march i'll have a filename like: 20160302-myfile
2 march - 20160301-myfile

I retain the files in folder for 3 months so just using *-myfile doesn't work for me.

Can splunk regex autoincrement the date everyday?

somesoni2 — Thu, 03 Mar 2016 20:52:16 GMT

So, the data is ingested already and you want to alert OR check if you received file for today (or Yesterday) using Splunk search?

aniketb — Thu, 03 Mar 2016 20:55:46 GMT

Yes my log does show it. e.g.

today's log will show

/my folder/ mysubfolder 20160302-myfile.zip 20160301-myfile.zip .....

I need the search string to search on:

sourcetype=xyz "/my folder/ mysubfolder" 20160301 (this variable should change automatically everyday)

somesoni2 — Thu, 03 Mar 2016 21:17:25 GMT

Try something like this

sourcetype=xyz "/my folder/ mysubfolder" [| gentimes start=-1 | eval search=strftime(now(),"%Y%m%d') | table search ]

The subsearch will generate a value in the format %Y%m%d (2010303 for today) and return the text value of it to main search.