Splunk Search

Regex command with eval regex-expression

kaspean
Loves-to-Learn Lots

I am beginner with splunk and want to filter the log lines with matching file name field but file name (Ex. file_name=XXXXXX.abc.XXX.20210326.XXX.txt) have date as part of its value which varies as per current day. 

I tried the below approach and it didn't help.

 index=xyz source="/logs/logfile.log"
| eval filename_expr="%abc%".strftime(now(), "%Y%m%d")."%"
| regex file_name=filename_expr
| stats count by source

Please advise.

Labels (2)
0 Karma

rnowitzki
Builder

Hi @kaspean 

Try it with where like instead of the regex command:

| where like(file_name, filename_expr)


BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...