Splunk Search

Reading from a specific log file

rsmall13
Explorer

Hi, I am very new to Splunk.  I would like to know how to search just the latest  log file from the below screenshot. (i.e. the current days file only)

rsmall13_0-1615806586536.png

At the moment I have the below search query , but this is pulling all the files so I'm just not sure how of the syntax for adding the current days date string.  Ultimately I am looking to find errors real time which send an alert.

source="d:\\logs\\gmoaisfabricsync\\fabricsyncservice-*.txt"

Cheers,
Rob

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rsmall13,

if every file contains only events of a specific day, you could use your search restricting the time period of your search (e.g. today, or yesterday or the last 24 hours).

Only one hint: use always the index condition to have faster searches.

Ciao.

Giuseppe

View solution in original post

rsmall13
Explorer

Ok thanks, that should work!  I am also using an index as well.

 

index="test_apps" AND sourcetype="gao" source="D:\\logs\\GmoAisFabricSync\\FabricSyncService-*.txt"

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rsmall13,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rsmall13,

if every file contains only events of a specific day, you could use your search restricting the time period of your search (e.g. today, or yesterday or the last 24 hours).

Only one hint: use always the index condition to have faster searches.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...