Splunk Search

Dynamic search for multi sources

Laxman24
Explorer

Hi All,

I need some help in searching,
so I have 1 index but it has multiple sources,

Index = Index1

and within the index, it has few sources

file_2021-05-14.csv
file_2021-05-15.csv
file_2021-05-16.csv

I'd like to make a search that the source will be dynamically depending on today date,

Index=Index1 source = "file_yyyy_mm_dd.csv" 

is this possible?

Thank you!

Labels (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Laxman24 

Can you please try this?

index=index1 [| makeresults | eval source="file_".strftime(now(),"%Y-%m-%d").".csv" | table source]

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Laxman24 

Can you please try this?

index=index1 [| makeresults | eval source="file_".strftime(now(),"%Y-%m-%d").".csv" | table source]

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

Laxman24
Explorer

@kamlesh_vaghela 

Hey Thanks!!

yes it worked the way i wanted,

thanks again!

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...