Splunk Search

How to seach using a concatenated string



I have a lot of sources like this:


and I want to make a search with a substring with part of the file name because the path and the host could change:


But the search is:

sourcetype="mysourcetype" | eval namefile="*-2011-Dec-12.csv" | where source=namefile

doesn't word due to the wildchar (*) because the search:

sourcetype="mysourcetype" | eval namefile="/u01/app/oracle/admin/AUD/audit/report/host-audit-report-2011-Dec-12.csv" | where source=namefile

works perfectly.
Obviously I semplified the subsearch. In the eval function I will use the strftime function to extract year, month and day of today or yesterday and so on.
Any suggestions to use wildchar?

0 Karma


Another option would be to just define a sourcetype for each source to keep things simpler. In your eval you have an issue with the wildcard as you have it surrounded with " "'s which turn it into a string literal, removing these will not make any difference as you can't store a wildcard in a variable defined by eval like that (that I am aware of)

Otherwise MHibbins suggestion to just search for source=*-2011-Dec-12.csv would work much better.


Not sure if you have already tried this, but a simpler solution should be to search...


or if the date changes...


Hope this answers your question.

If it does answer your question, please mark the answer as accepted (the tick next to the answer) for the benefit of the community.



0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...