Splunk Search

How to setup a query to search and find file names with the current time value?

Log_wrangler
Builder

Hi,

I have a query that searches a field i.e. filenames with a value in this format >>

filename = folder_name/sub_folder_name/date/data   
for example 
filename=email/outlook/2019/03/25/outlook-2019-03-15-12:05:00:987Z

I am looking to create an alert when the folder is not populated with data, and I want to use a now() or other time variable in the file name.

for example

index=main sourcetype=files filename=email/outlook/{time variable}/*   

So if today is 3/15/2019 the current date variable would be 2019/03/15, and tomorrow the query would use 2019/03/16 as the variable...

I hope that makes sense. I basically want to search a field using a current date variable...

Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=main sourcetype=files [ |makeresults | eval filename = "email/outlook/" . strftime(now(), "%Y/%m/%d") . "/*" | format ]

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index=main sourcetype=files [ |makeresults | eval filename = "email/outlook/" . strftime(now(), "%Y/%m/%d") . "/*" | format ]
0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...