Splunk Search

I need to return only results where the "source" contains the current date.

griffinpair
Path Finder

Example:

source="D:\filepath\filepath\filepath\filepath\DebugImportHelper_7_25_2017.log"

This log file is created everyday with the current date. I want a search where is runs real time and only returns data from source that contains the current date. My current search looks like this (asterisks do not show, so $ represents where asterisks would be):

source=$"D:\filename\filename$ source=$filename\filename$ source=$clientID$ Start
| eval today=strftime(now(), "%m_%d_%Y") | where source=$today$
| eval time=strftime(round(strptime(full_Time, "%I:%M:%S %P")), "%H:%M:%S")
| eval late=if(time>"15:00:00", 1, 0)

| table Action, full_Date, full_Time, time, late, source

The "eval today=strftime(now(), "%m/%d/%Y") | where source=$today$" part returns the right date format, but the "where" does not work.

0 Karma
1 Solution

somesoni2
Revered Legend

The where clause doesn't support wildcards directly. You've to use either the like or match function with it. Where command requires % as wildcard character.

...| where like(source,"%".today."%") | ....

OR, match, which does 'contains' type of matching so you don't need a wildcard there.

...| where like(source,today) | ....

View solution in original post

somesoni2
Revered Legend

The where clause doesn't support wildcards directly. You've to use either the like or match function with it. Where command requires % as wildcard character.

...| where like(source,"%".today."%") | ....

OR, match, which does 'contains' type of matching so you don't need a wildcard there.

...| where like(source,today) | ....

griffinpair
Path Finder

This was exactly what I was looking for. Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...