Getting Data In

How to search for a source file with a timestamp in the name?

karthikTIL
Path Finder

HI, I have files everyday with timestamp automatically like
report_3nov2014.csv
report_4nov2014.csv
report_5nov2014.csv, etc

Please let me know how do i search file generated today(report_3nov2014.csv) based on timestamp while i search using source="..." command

Tags (3)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Another alternative

index=blah sourcetype=blahblah source=[|gentimes start=-1 | eval search="*report_" + strftime(now(), "%e%b%Y") + ".csv" | table search] | rest of your search...

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Another alternative

index=blah sourcetype=blahblah source=[|gentimes start=-1 | eval search="*report_" + strftime(now(), "%e%b%Y") + ".csv" | table search] | rest of your search...

MuS
SplunkTrust
SplunkTrust

Hi karthikTIL,

try something like this:

... | eval file_date=strftime(now(), "%e%b%Y") | eval mySource="report_" + file_date + ".csv" | where match(source, mySource) | ...

or a more generic approach

... | eval file_date=strftime(now(), "%e%b%Y") | eval mySource="." + file_date + "." | where match(source, mySource) | ...

This will use the mySource field as regex on the source field and returns all sources with matching dates in the value.

hope this helps ...

cheers, MuS

karthikTIL
Path Finder

Thank you!

0 Karma

MuS
SplunkTrust
SplunkTrust

another approach just came up my mind:
if you always need today's or yesterday's date in the source name, than you could use an eval based macro containing something like this:

strftime(relative_time(time(), "-d"), "%e%b%Y") 

If your macro is named yesterday you can use it like this in your searches:

 index=foo  source=*`yesterday`* | ...
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...