Splunk Search

Read data between in log file based on date

axs21
New Member

Hi,

I have a log file and want to read everyday data only.
File Format is like

sometextsometext
Friday, March 9, 2018 03:08:15 PM SGT
Somedata
Somedata
Friday, March 10, 2018 03:08:15 PM SGT
SomeDataSomeData
Saturday, March 11, 2018 03:08:15 PM SGT

I want to read data from previous day to current day. Is is possible ? Please suggest.
E.g. in above file,
I want to read data between March 9 to March 10
Next Day, I want to read from March 10 to March 11
and so on

Is it possible to achieve? Please suggest.
Thanks,
AXS

Tags (1)
0 Karma

valiquet
Contributor

Relative time windows is the solution. But it does not make much sense, how can you read logs from today if the day is not finish?

| search earliest=-@1d latest=+@1d 

You should instead

| search earliest=-1d
0 Karma

axs21
New Member

Splunk reads whole file everyday and it can lead to increase in DB size.
I want Splunk to only data between current and next day date from log file.

No like first Splunk whole file and do indexing and then it give me one day data.

0 Karma

somesoni2
Revered Legend

How often the file is updated, real-time or once a day??

0 Karma

axs21
New Member

The file is updated on realtime.
Another thing is splunk reads whole file but I want Splunk to read data only from current date and to next date from log file.

0 Karma

elliotproebstel
Champion

Is the data from this file indexed into Splunk? What dictates an event break - each new line? Or is this data in a lookup file?

0 Karma

axs21
New Member

Each new line dictates an event break

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Enriching Signals with the OTel Lookup Processor

Introduction Raw telemetry is often incomplete. A log line might record an IP address, but what you really ...

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

Painting a Clearer Picture: Unifying Your Investigations with Cisco AI Canvas

Painting a Clearer Picture: Unifying Your Investigations with Cisco AI Canvas  We’ve all been there. You’re ...