Getting Data In

How to search for a source file with a timestamp in the name?

karthikTIL
Path Finder

HI, I have files everyday with timestamp automatically like
report_3nov2014.csv
report_4nov2014.csv
report_5nov2014.csv, etc

Please let me know how do i search file generated today(report_3nov2014.csv) based on timestamp while i search using source="..." command

Tags (3)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Another alternative

index=blah sourcetype=blahblah source=[|gentimes start=-1 | eval search="*report_" + strftime(now(), "%e%b%Y") + ".csv" | table search] | rest of your search...

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Another alternative

index=blah sourcetype=blahblah source=[|gentimes start=-1 | eval search="*report_" + strftime(now(), "%e%b%Y") + ".csv" | table search] | rest of your search...

MuS
SplunkTrust
SplunkTrust

Hi karthikTIL,

try something like this:

... | eval file_date=strftime(now(), "%e%b%Y") | eval mySource="report_" + file_date + ".csv" | where match(source, mySource) | ...

or a more generic approach

... | eval file_date=strftime(now(), "%e%b%Y") | eval mySource="." + file_date + "." | where match(source, mySource) | ...

This will use the mySource field as regex on the source field and returns all sources with matching dates in the value.

hope this helps ...

cheers, MuS

karthikTIL
Path Finder

Thank you!

0 Karma

MuS
SplunkTrust
SplunkTrust

another approach just came up my mind:
if you always need today's or yesterday's date in the source name, than you could use an eval based macro containing something like this:

strftime(relative_time(time(), "-d"), "%e%b%Y") 

If your macro is named yesterday you can use it like this in your searches:

 index=foo  source=*`yesterday`* | ...
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...