Splunk Search

Regex for changing date

aniketb
Path Finder

Hi,

I want to check daily if my file generated successfully. The filename is prefixed by date so e.g.

3 march i'll have a filename like: 20160302-myfile
2 march - 20160301-myfile

I retain the files in folder for 3 months so just using *-myfile doesn't work for me.

Can splunk regex autoincrement the date everyday?

Tags (3)
0 Karma

somesoni2
Revered Legend

Try something like this

sourcetype=xyz "/my folder/ mysubfolder" [| gentimes start=-1 | eval search=strftime(now(),"%Y%m%d') | table search ] 

The subsearch will generate a value in the format %Y%m%d (2010303 for today) and return the text value of it to main search.

0 Karma

somesoni2
Revered Legend

So, the data is ingested already and you want to alert OR check if you received file for today (or Yesterday) using Splunk search?

0 Karma

aniketb
Path Finder

Yes my log does show it. e.g.

today's log will show

/my folder/ mysubfolder 20160302-myfile.zip 20160301-myfile.zip .....

I need the search string to search on:

sourcetype=xyz "/my folder/ mysubfolder" 20160301 (this variable should change automatically everyday)

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...