Splunk Search

Dynamic search for multi sources

Laxman24
Explorer

Hi All,

I need some help in searching,
so I have 1 index but it has multiple sources,

Index = Index1

and within the index, it has few sources

file_2021-05-14.csv
file_2021-05-15.csv
file_2021-05-16.csv

I'd like to make a search that the source will be dynamically depending on today date,

Index=Index1 source = "file_yyyy_mm_dd.csv" 

is this possible?

Thank you!

Labels (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Laxman24 

Can you please try this?

index=index1 [| makeresults | eval source="file_".strftime(now(),"%Y-%m-%d").".csv" | table source]

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Laxman24 

Can you please try this?

index=index1 [| makeresults | eval source="file_".strftime(now(),"%Y-%m-%d").".csv" | table source]

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

Laxman24
Explorer

@kamlesh_vaghela 

Hey Thanks!!

yes it worked the way i wanted,

thanks again!

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...