Splunk Search

Splunk Query

sunket6006
Engager

Hello,

I am looking for a Splunk query that could match date as below.

"*Execution failure in Transferring Transaction Billing File :: 210609*"

This is the logs I get for a file transfer with yesterdays date, how can search that could replace the static date to dynamic. I want a query that could search for above texts and equivalent yesterdays everyday.

Labels (3)
0 Karma

sunket6006
Engager

Actually I was trying to use this query, but it sis not working as expected.

index=securecode host IN (cjb4stl181) sourcetype=securecode:billing:txn_gft "*Execution failure in Transferring Transaction Billing File :: " .strftime(relative_time(now(), "-1d@d"), "%y%m%d") . "*"

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!