Regex command with eval regex-expression - Splunk Community

Splunk Search

I am beginner with splunk and want to filter the log lines with matching file name field but file name (Ex. file_name=XXXXXX.abc.XXX.20210326.XXX.txt) have date as part of its value which varies as per current day.

I tried the below approach and it didn't help.

index=xyz source="/logs/logfile.log"
| eval filename_expr="%abc%".strftime(now(), "%Y%m%d")."%"
| regex file_name=filename_expr
| stats count by source

Please advise.

Hi @kaspean

Try it with where like instead of the regex command:

| where like(file_name, filename_expr)

BR
Ralph

--
Karma and/or Solution tagging appreciated.

Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

Now On Demand Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

Now On Demand Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...