Splunk Search

Reading from a specific log file

rsmall13
Explorer

Hi, I am very new to Splunk.  I would like to know how to search just the latest  log file from the below screenshot. (i.e. the current days file only)

rsmall13_0-1615806586536.png

At the moment I have the below search query , but this is pulling all the files so I'm just not sure how of the syntax for adding the current days date string.  Ultimately I am looking to find errors real time which send an alert.

source="d:\\logs\\gmoaisfabricsync\\fabricsyncservice-*.txt"

Cheers,
Rob

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rsmall13,

if every file contains only events of a specific day, you could use your search restricting the time period of your search (e.g. today, or yesterday or the last 24 hours).

Only one hint: use always the index condition to have faster searches.

Ciao.

Giuseppe

View solution in original post

rsmall13
Explorer

Ok thanks, that should work!  I am also using an index as well.

 

index="test_apps" AND sourcetype="gao" source="D:\\logs\\GmoAisFabricSync\\FabricSyncService-*.txt"

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rsmall13,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rsmall13,

if every file contains only events of a specific day, you could use your search restricting the time period of your search (e.g. today, or yesterday or the last 24 hours).

Only one hint: use always the index condition to have faster searches.

Ciao.

Giuseppe

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!