Getting Data In
Highlighted

How to search for sources with a timestamp pattern

Champion

Hi,

I want to search for a set of files that end in YYYYMMDDHHMMSSPID.log format and I want to search on files that match today's date. How would I do that?

0 Karma
Highlighted

Re: How to search for sources with a timestamp pattern

Esteemed Legend

Like this:

<other parts of base search>  [|noop|stats count AS source|eval source=strftime(now(), "*%Y%m%d_*_*")]
0 Karma
Highlighted

Re: How to search for sources with a timestamp pattern

Champion

Thanks. PID is actually a number, which can vary in length. How would I grab that as well?

0 Karma
Highlighted

Re: How to search for sources with a timestamp pattern

Esteemed Legend

Answer updated.

0 Karma
Highlighted

Re: How to search for sources with a timestamp pattern

Champion

Thanks. Not working...

Here is a sample sources:

ORSMMKNode2PR.20160409224023783.log
ORS
RTPNode1PR.20160409221411433.log
ORSOMANode3PR.20160409214537963.log

ORS
MMKNode1PR.20160409212722403.log

Here's my search:

index=main sourcetype=checklogpermissions RESOURCETYPE=file (RESOURCE!="du" AND RESOURCE!="cd") |fields RESOURCE |table RESOURCE | eval filedate=strftime(now(), "%Y%m%d*") |eval mySource="ORS_Node*PR." + file_date + ".log" |where match(RESOURCE,mySource)

Comes back with nothing. If I remove the where clause, it comes back with a bunch. I'd like to be able to search across all the source examples, using wildcards, rather than hard-coding anything.

0 Karma
Highlighted

Re: How to search for sources with a timestamp pattern

Esteemed Legend

You didn't tell me that the field in question is RESOURCE. This is why you should ALWAYS post your search strings. I naturally assumed that you were using field source. Try this:

index=main sourcetype=check_log_permissions RESOURCE_TYPE=file (RESOURCE!="du" AND RESOURCE!="cd") [|noop|stats count AS RESOURCE|eval RESOURCE=strftime(now(), "*%Y%m%d_*_*")]
0 Karma
Highlighted

Re: How to search for sources with a timestamp pattern

Ultra Champion

Use a regex tool to define/mature your pattern - https://regex101.com/ is great!

0 Karma