I have a bunch of Splunk buckets (directories) that contain two epoch timestamps in their names. I need to find a way to perform a find on those filenames to locate any files that whose second epoch time is between 1488344400 (March 1, 2017) and 1497499200 (June 15, 2017). The format of the filename is as follows:

db_1274129994_1273525194_0 (db_latesttime_earliesttime_idnum)

The "earliesttime" is the determining factor as the latest can extend past the dates.

  • 1
    Please read your question and explain: what do you want find, how, what does that have to do with directories with funny names, what do you mean by "second epoch time" of a file, what does this have to do with "earliesttime". Sep 20, 2017 at 15:42
  • If you look at the file name there are two epoch times listed in it - the second time is what I am interested in, I need to perform a find on the filenames in the range listed above that pertain only to the first epoch in the file name.
    – J Telep
    Sep 20, 2017 at 15:57
  • 1
    What I'd like to do is read your question and understand what you're asking, without needing further input. Sep 20, 2017 at 16:05

3 Answers 3


Using bash:

for d in db_*_*_*; do
    if [[ "$d" =~ db_([0-9]*)_([0-9]*) ]]; then
        if [[ "${BASH_REMATCH[2]}" -ge 1488344400 ]] &&
           [[ "${BASH_REMATCH[2]}" -le 1497499200 ]]; then
            printf 'Found "%s"\n' "$d"

This iterates over all db_*_*_* names in the current directory. If any name matches the regular expression db_([0-9]*)_([0-9]*), then a numerical comparison is carried out on the last of the two found numbers in the name. If the comparison comes out true, then the name is reported on standard output.

ls /path/to/your/buckets | awk -F_ '$3 >= 1488344400 && $3 <= 1497499200'

Note: in the general case, one must not parse ls, but since we know that our filenames won't contain special characters, we shouldn't get into trouble in this particular case.

As for the awk: we simply define _ as the field separator and print all lines where the third field ("earliesttime" according to you) is between the epoch times you mentioned.


With bash:

for f in db_[0-9]*_[0-9]*; do 
    e_time="${f:14:10}"    # extracting 'earliest time'
    if [ $e_time -ge 1488344400 ] && [ $e_time -le 1497499200 ]; then 
        echo "$f"
  • @n.st, will someone live till that time 20 November 2286 ? For now, we have fixed format described in the question Sep 20, 2017 at 16:10
  • 1
    Maybe not until that time, but (hopefully) at that time. Do not underestimate the longevity of "quick and dirty" hacks! I am joking, of course. Still, it doesn't hurt to keep in mind the limitations you're dealing with (like with parsing ls in my solution).
    – n.st
    Sep 20, 2017 at 16:13
  • Minor warning on the loop glob expression: It looks like a regular expression, but it ain't.
    – Kusalananda
    Sep 20, 2017 at 17:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .