Splunk Search

How to setup a query to search and find file names with the current time value?

Log_wrangler
Builder

Hi,

I have a query that searches a field i.e. filenames with a value in this format >>

filename = folder_name/sub_folder_name/date/data   
for example 
filename=email/outlook/2019/03/25/outlook-2019-03-15-12:05:00:987Z

I am looking to create an alert when the folder is not populated with data, and I want to use a now() or other time variable in the file name.

for example

index=main sourcetype=files filename=email/outlook/{time variable}/*   

So if today is 3/15/2019 the current date variable would be 2019/03/15, and tomorrow the query would use 2019/03/16 as the variable...

I hope that makes sense. I basically want to search a field using a current date variable...

Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=main sourcetype=files [ |makeresults | eval filename = "email/outlook/" . strftime(now(), "%Y/%m/%d") . "/*" | format ]

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index=main sourcetype=files [ |makeresults | eval filename = "email/outlook/" . strftime(now(), "%Y/%m/%d") . "/*" | format ]
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...