Splunk Search

Finding embedded dates for an automated search

jboustead
Explorer

My search is pulling out events with the date embedded within the event, eg:

[2020-10-05 07:23:08.308] ALL **** sending file= /u01/shared/pc/files/OUT/IF_148/Transferring/XXX_XXXXXX..XX_LUIS_312XXX_20201005_001.csv

 

[2020-10-05 13:40:17.101] ALL **** sending file= /u01/shared/pc/files/OUT/IF_148/Transferring/XXX_XXXXXX..XX_EDIW_312XXX_20200721_003.CSV

The embedded dates in the format '202001005' & '202001005' respectively. Is there a way to search in Splunk for events that will only pick up the events for a certain date embedded within them? - without having to manually alter the search each time?

 

(current search for ref: **** sending file= /u01/shared/pc/files/OUT/IF_148/Transferring/*312*)

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The regex command may help.  It filters events based on a regular expression.

index=foo "**** sending file= /u01/shared/pc/files/OUT/IF_148/Transferring/*312*"
| regex file="2020\d{4}"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The regex command may help.  It filters events based on a regular expression.

index=foo "**** sending file= /u01/shared/pc/files/OUT/IF_148/Transferring/*312*"
| regex file="2020\d{4}"
---
If this reply helps you, Karma would be appreciated.

jboustead
Explorer

That is great - thanks  !

I am currently trying to use a regex to pick out the events with the date '2020XXXX' - I want the regex to search pick up any event date providing it does not have 'reg' following the '.' or '_' (pick out all the event dates below, except the first). How do I do this? 

Current regex: 2020\d{4}[\.\_]

List of different events\logs from the splunk search:

_20201007144100_20200416_reg.zip

_20201007103200_20201007.zip

_20201007095000_20201007.zip

_20201007092933_20201007.zip

_20201007061717_20201007_txn.zip

_20201007041719_20201007.zip

@drich

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...