How to search for a source file with a timestamp in the name?

[karthikTIL]

HI, I have files everyday with timestamp automatically like
report_3nov2014.csv
report_4nov2014.csv
report_5nov2014.csv, etc

Please let me know how do i search file generated today(report_3nov2014.csv) based on timestamp while i search using source="..." command

[somesoni2 · Accepted solution]

Another alternative

index=blah sourcetype=blahblah source=[|gentimes start=-1 | eval search="*report_" + strftime(now(), "%e%b%Y") + ".csv" | table search] | rest of your search...

[MuS]

Hi karthikTIL,

try something like this:

... | eval file_date=strftime(now(), "%e%b%Y") | eval mySource="report_" + file_date + ".csv" | where match(source, mySource) | ...

or a more generic approach

... | eval file_date=strftime(now(), "%e%b%Y") | eval mySource="." + file_date + "." | where match(source, mySource) | ...

This will use the mySource field as regex on the source field and returns all sources with matching dates in the value.

hope this helps ...

cheers, MuS

[karthikTIL]

Thank you!

[MuS]

another approach just came up my mind:
if you always need today's or yesterday's date in the source name, than you could use an eval based macro containing something like this:

strftime(relative_time(time(), "-d"), "%e%b%Y") 

If your macro is named yesterday you can use it like this in your searches:

 index=foo  source=*`yesterday`* | ...