I am beginner with splunk and want to filter the log lines with matching file name field but file name (Ex. file_name=XXXXXX.abc.XXX.20210326.XXX.txt) have date as part of its value which varies as per current day.
I tried the below approach and it didn't help.
index=xyz source="/logs/logfile.log"| eval filename_expr="%abc%".strftime(now(), "%Y%m%d")."%"| regex file_name=filename_expr| stats count by source
Hi @kaspean Try it with where like instead of the regex command:
| where like(file_name, filename_expr)