Splunk Search

Reading from a specific log file

rsmall13
Explorer

Hi, I am very new to Splunk.  I would like to know how to search just the latest  log file from the below screenshot. (i.e. the current days file only)

rsmall13_0-1615806586536.png

At the moment I have the below search query , but this is pulling all the files so I'm just not sure how of the syntax for adding the current days date string.  Ultimately I am looking to find errors real time which send an alert.

source="d:\\logs\\gmoaisfabricsync\\fabricsyncservice-*.txt"

Cheers,
Rob

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rsmall13,

if every file contains only events of a specific day, you could use your search restricting the time period of your search (e.g. today, or yesterday or the last 24 hours).

Only one hint: use always the index condition to have faster searches.

Ciao.

Giuseppe

View solution in original post

rsmall13
Explorer

Ok thanks, that should work!  I am also using an index as well.

 

index="test_apps" AND sourcetype="gao" source="D:\\logs\\GmoAisFabricSync\\FabricSyncService-*.txt"

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rsmall13,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rsmall13,

if every file contains only events of a specific day, you could use your search restricting the time period of your search (e.g. today, or yesterday or the last 24 hours).

Only one hint: use always the index condition to have faster searches.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...