Splunk Search

Use parametric time variable in source name

nicofantinato
Path Finder

Hello to everybody,

we are trying to set a search that makes a diff between two files of two different days. This is the working search:

 

| set diff
[| search index=myindex source="*2021-08-27*.csv"
| stats count by idx
| table idx]
[ search index=myindex source="*2021-08-26*.csv"
| stats count by idx
| table idx]
| join idx
[ search index=myindex source="*2021-08-27*.csv"]
| table "SITE ID",idx,"Title",FQDN,"Asset Primary Identifier","IP Address",Hostname,"Operating System", Port

 


However, we'd like to make it parametric, we'd like dates contained in source names are calculated automatically, so we tried to insert this:

 

| set diff 
    [ | eval todayFile=strftime(now(),"*%Y-%m-%d*.csv")
    | search index=myindex source=todayFile
    | stats count by idx 
    | table idx] 
    [ search index=myindex source="*2021-08-25*.csv" 
    | stats count by idx 
    | table idx] 
| join idx 
    [ search index=myindex source=todayFile] 
| table "SITE ID",idx,"Title",FQDN,"Asset Primary Identifier","IP Address",Hostname,"Operating System", Port

 

but it's not working, or, better, it doesn't return errors but it doesn't return correct results either.

How can we substitute source="*2021-08-25*.csv" with an instruction that dynamically inserts today date in our source filename in order to run the search every day?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Rather than setting the lookup name in an eval, use a subsearch.  Try this query.

| set diff 
    [ | search index=myindex [ | makeresults 
        | eval source=strftime(now(),"*%Y-%m-%d*.csv") | return source ]
    | stats count by idx 
    | table idx] 
    [ search index=myindex source="*2021-08-25*.csv" 
    | stats count by idx 
    | table idx] 
| join idx 
    [ search index=myindex [ | makeresults 
        | eval source=strftime(now(),"*%Y-%m-%d*.csv") | return source ] ] 
| table "SITE ID",idx,"Title",FQDN,"Asset Primary Identifier","IP Address",Hostname,"Operating System", Port

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Rather than setting the lookup name in an eval, use a subsearch.  Try this query.

| set diff 
    [ | search index=myindex [ | makeresults 
        | eval source=strftime(now(),"*%Y-%m-%d*.csv") | return source ]
    | stats count by idx 
    | table idx] 
    [ search index=myindex source="*2021-08-25*.csv" 
    | stats count by idx 
    | table idx] 
| join idx 
    [ search index=myindex [ | makeresults 
        | eval source=strftime(now(),"*%Y-%m-%d*.csv") | return source ] ] 
| table "SITE ID",idx,"Title",FQDN,"Asset Primary Identifier","IP Address",Hostname,"Operating System", Port

 

---
If this reply helps you, Karma would be appreciated.

nicofantinato
Path Finder

It works!

Many thanks

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...