Getting Data In

How to search for a source file with a timestamp in the name?

karthikTIL
Path Finder

HI, I have files everyday with timestamp automatically like
report_3nov2014.csv
report_4nov2014.csv
report_5nov2014.csv, etc

Please let me know how do i search file generated today(report_3nov2014.csv) based on timestamp while i search using source="..." command

Tags (3)
1 Solution

somesoni2
Revered Legend

Another alternative

index=blah sourcetype=blahblah source=[|gentimes start=-1 | eval search="*report_" + strftime(now(), "%e%b%Y") + ".csv" | table search] | rest of your search...

View solution in original post

somesoni2
Revered Legend

Another alternative

index=blah sourcetype=blahblah source=[|gentimes start=-1 | eval search="*report_" + strftime(now(), "%e%b%Y") + ".csv" | table search] | rest of your search...

MuS
SplunkTrust
SplunkTrust

Hi karthikTIL,

try something like this:

... | eval file_date=strftime(now(), "%e%b%Y") | eval mySource="report_" + file_date + ".csv" | where match(source, mySource) | ...

or a more generic approach

... | eval file_date=strftime(now(), "%e%b%Y") | eval mySource="." + file_date + "." | where match(source, mySource) | ...

This will use the mySource field as regex on the source field and returns all sources with matching dates in the value.

hope this helps ...

cheers, MuS

karthikTIL
Path Finder

Thank you!

0 Karma

MuS
SplunkTrust
SplunkTrust

another approach just came up my mind:
if you always need today's or yesterday's date in the source name, than you could use an eval based macro containing something like this:

strftime(relative_time(time(), "-d"), "%e%b%Y") 

If your macro is named yesterday you can use it like this in your searches:

 index=foo  source=*`yesterday`* | ...
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...