Splunk Search

How to write a search using an eval object with a wildcard?

sfellin
Engager

I am trying to use an eval object as the basis of a search pattern along with a wildcard and Splunk is not happy with my efforts.

I have a field (DATE_FIELD) with data such as 20160419_003425 and I'm trying to collect all of the current day's events only:

create a variable with today's date > search against a field using variable + wildcard

Tried:
index=myIndex | eval now=now(), today=strftime(now(), "%Y%m%d") | search DATE_FIELD = `today`* >> throws error
index=myIndex | eval now=now(), today=strftime(now(), "%Y%m%d") | search DATE_FIELD = today*
index=myIndex | eval now=now(), today=strftime(now(), "%Y%m%d") | where DATE_FIELD = `today`*
index=myIndex | eval now=now(), today=strftime(now(), "%Y%m%d") | where DATE_FIELD = today*
index=myIndex | eval now=now(), today=strftime(now(), "%Y%m%d") | where like(DATE_FIELD, "today%")

Feel like there's an obvious way to accomplish this, but haven't located it yet; requirement is current day (and current day only). Of course, enjoy the simpler solution rather than over-engineering (sure I could make a three-line regex...)

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

index=myindex | where LIKE(DATE_FIELD,strftime(now(), "%Y%m%d") ."_%")

OR

index=myindex | where match(DATE_FIELD,strftime(now(), "%Y%m%d") ."_.*")

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this

index=myindex | where LIKE(DATE_FIELD,strftime(now(), "%Y%m%d") ."_%")

OR

index=myindex | where match(DATE_FIELD,strftime(now(), "%Y%m%d") ."_.*")
0 Karma

sfellin
Engager

Thanks; I used a regex on the field to capture the first 8 digits to compare it to the eval but this is a cleaner approach -- switched!

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...