I want to check daily if my file generated successfully. The filename is prefixed by date so e.g.
3 march i'll have a filename like: 20160302-myfile
2 march - 20160301-myfile
I retain the files in folder for 3 months so just using *-myfile doesn't work for me.
Can splunk regex autoincrement the date everyday?
Try something like this
sourcetype=xyz "/my folder/ mysubfolder" [| gentimes start=-1 | eval search=strftime(now(),"%Y%m%d') | table search ]
The subsearch will generate a value in the format %Y%m%d (2010303 for today) and return the text value of it to main search.
Yes my log does show it. e.g.
today's log will show
/my folder/ mysubfolder 20160302-myfile.zip 20160301-myfile.zip .....
I need the search string to search on:
sourcetype=xyz "/my folder/ mysubfolder" 20160301 (this variable should change automatically everyday)