Another alternative
index=blah sourcetype=blahblah source=[|gentimes start=-1 | eval search="*report_" + strftime(now(), "%e%b%Y") + ".csv" | table search] | rest of your search...
Another alternative
index=blah sourcetype=blahblah source=[|gentimes start=-1 | eval search="*report_" + strftime(now(), "%e%b%Y") + ".csv" | table search] | rest of your search...
Hi karthikTIL,
try something like this:
... | eval file_date=strftime(now(), "%e%b%Y") | eval mySource="report_" + file_date + ".csv" | where match(source, mySource) | ...
or a more generic approach
... | eval file_date=strftime(now(), "%e%b%Y") | eval mySource="." + file_date + "." | where match(source, mySource) | ...
This will use the mySource
field as regex on the source
field and returns all sources with matching dates in the value.
hope this helps ...
cheers, MuS
Thank you!
another approach just came up my mind:
if you always need today's or yesterday's date in the source name, than you could use an eval based macro containing something like this:
strftime(relative_time(time(), "-d"), "%e%b%Y")
If your macro is named yesterday
you can use it like this in your searches:
index=foo source=*`yesterday`* | ...