Splunk Search

Specifying today's date in the source file on a search

DavidGuarneri
Path Finder

Is there a way to specify today's date in the filename of the source on the search? I'm thinking in the same way you would put it in a bash script. Pseudocode:

source="C:logs\\path\\iislog_(time(%y%m%d)).log"

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

use the function now() in a subsearch or a macro.

the search to generate a condition :

| stats count | eval date=strftime(now(),"%Y%m%d") | eval source="C:logs\\path\\iislog_".date.".log" | table source

the search using the sub search to generate a source condition

* [ | stats count | eval date=strftime(now(),"%Y%m%d") | eval source="C:logs\\path\\iislog_".date.".log" | table source]

you could improve by using a macro too.

Ayn
Legend

Use a subsearch:

[| stats count | eval source="C:\\logs\\path\\iislog".strftime(now(),"%y%m%d").".log" | fields source]

DavidGuarneri
Path Finder

That worked, thank you!

0 Karma

yannK
Splunk Employee
Splunk Employee

You are a kung fu master Ayn !

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...