Splunk Search

Include source file that ended with date (not bz2)


Need to declare in spl Include only those file that has ended with date not .bz2 (I don’t want to use  NOT)


Here is spl:

index="myindex" source="/data/app/20211209/CUS/app.log.*" | dedup source| table source






I try below spl but doesn’t return result



Any idea?


Labels (5)
0 Karma

Splunk Employee
Splunk Employee

There is no problem using NOT source=*bz2 ... or source !=*.bz2 assuming you mention source=...

Adding an extra filter after a pipe with any where/search/regex option would not give you the best performance.

If this is a real problem, then consider indexing the bz2 files in another index.

You should also find your data by narrowing down to the sourcetype, no ?


Ultra Champion

Unfortunately, the filter part of the search does not in itself provide support for regexes, so you can only match on simple wildcards.

But, since you're only interested in the source field values, it's way, way more effective to use tstats instead of simple search and statsing.

For example

| tstats values(source) as source where index=myindex"
| mvexpand source
| regex source="/data/app/.*\d{4}-\d{2}-\d{2}$"

 In general case - @richgalloway 's soultion is quite ok. It's just that in this particular case |tstats is way faster.


A regular expression should do the job.  Use a wildcard in the base search to select events, then narrow the selection using regex.

index="myindex" source="/data/app/20211209/CUS/app.log.*" 
| regex source="app\.log\.\d{4}-\d\d-\d\d$"
| dedup source
| table source
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...