Is it possible to run a search with a cron expression inside the search?

[prakashbhanu407]

My requirement is to monitor files daily, weekly, monthly, and quarterly and I have to search during a specific time period for all these types of files and show how many were not received.

Not sure if this logic will work, but I wanted to check if we could give the cron expression within the search to match all the possibilities during the given time range and show file types if they were not received.

So could you please let me know the syntax ...I am using the below for success scenario

index=app-axxfer-restricted queryType="ts" 
(
    (filename=FILE.PROD.CFSTFN.DT*.txt )
    OR 
    (filename=FILE.PROD.CFSTFNTRG.txt ) 
    OR
    (filename=ORECFLAT.FNT554.CECFSTTRG*.txt )
) 
status=1 |rename filename as FileName  | table FileName| stats count(FileName)

[somesoni2]

You may not event need to parse the cron. Try this and see if it suits your requirement

index=app-axxfer-restricted queryType="ts" ((filename=FILE.PROD.CFSTFN.DT*.txt ) OR (filename=FILE.PROD.CFSTFNTRG.txt ) OR (filename=ORECFLAT.FNT554.CECFSTTRG*.txt )) status=1 | table _time filename | sort 0 filename _time | streamstats current=f window=1 first(_time) as last_time by filename | eval timeSinceLastReceived=_time-last_time | MissingCount= round(timeSinceLastReceived/threshold)-1 | eval MissingCount>0

Where threshold is the value in second that you need to enter based on the frequency of the file arrival. E.g. for daily file, it would be 86400, for weekly 7*86400.. and so on

[prakashbhanu407]

Please confirm the below
1)Will it work if I give cron expression within the query
2)Syntax to use the Cron expression in a query