Splunk Search

return: eval filename=strftime(now(), with yesterdays count (as fileinformation)

knitz
Explorer

hello,

looking for some help.

I am running a search, daily.... but the logs in the source get updated late by the application (the app updates the source/log-file next day with values related to previous day) , so I want to run my search next day and return the result into an outputlookup.csv incl. the day-count of previous day.

in example: if my search runs daily ... let's say on day 9 (search is on previous day (8 = yesterday) it returns an outputlookup .csv as: file-name_%d.csv which is equal as file-name_09.csv (works perfectly)

I need to get it returned as: file-name_08.csv

below search I am using:

index="application-license" sourcetype=application License_User_device=* License_feature_status="OUT" License_user=*
| eval License_feature_status=(License_feature_status)
| eval License_User_device=split(License_User_device,",")
| eval License_user=split(License_user,",")
| makemv delim="," License_user
| mvexpand License_user
| sort License_user
| dedup License_user
| stats list(License_user) as "User" list(License_User_device) as "Computer" count(License_feature_status) as "LicenseTaken" by _time

| outputlookup [ | stats count | eval filename=strftime(now(), "Application-license-usage-per_day_%d.csv") | return $filename]

...................

I tried (without results):

| outputlookup [ | stats count | eval filename=strftime((now(),"-1d"), "Minitab-license-usage-per_day_%d.csv") | return $filename]
or
| outputlookup [ | stats count | eval filename=relative_time(now(), "-1d@d"), "%m/%d") | return $filename]


do you have any idea / solution for me?

thx in advance
Kai

0 Karma

manjunathmeti
Champion
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...