topic Re: how to extract date using rex? in Dashboards & Visualizations

how to extract date using rex?

avneet26 — Fri, 04 Dec 2020 09:14:27 GMT

how to extract date using rex command ? format is "time":"2020-12-04+01:00"

Re: how to extract date using rex?

gcusello — Fri, 04 Dec 2020 09:28:15 GMT

Hi @avneet26,

do you want:

to extract a date field from a log and put it in a field,
to parse a date at index time,
to display a date in a different format (e.g. from epochtime to your format)?

At first the date you used as sample is strange because it's a date with the timezone and without the time.

Anyway, in the first case, you can use a regex:

| rex "\"time\":\"(?<time>[^\"]+)\"

In the second case the TIME_FORMAT is (only for the date you shared!):

TIME_FORMAT=%Y-%m-%d%:z

If you want to display an epochtime date to the format you shared:

| eval time=strftime(time,"%y-%m-%d%:z")

or if you want to transfroma the date you shared in epochtime, the same using "strptime" function.

Ciao.

Giuseppe

Re: how to extract date using rex?

avneet26 — Fri, 04 Dec 2020 09:45:49 GMT

Hi.. i want the complete date field . for example i have taken the field "time":"2020-12-04+01:00" i will to extract starting from 2020 till 01:00 but using the first option you gave its not working. pls help.

Re: how to extract date using rex?

avneet26 — Fri, 04 Dec 2020 09:49:29 GMT

is it possible if we can extract only the date from the time field?

Re: how to extract date using rex?

gcusello — Fri, 04 Dec 2020 10:31:45 GMT

Hi @avneet26,

the regex I sent you is correct as you can check at https://regex101.com/r/GZafMf/1

Are you sure about the sample date you share? it's a strange timestamp: date and timezone without time!

Could you share other samples?

Ciao.

Giuseppe

Re: how to extract date using rex?

avneet26 — Fri, 04 Dec 2020 10:33:38 GMT

Hi, yes i am sure about the format. can you help me how i can extract only the date from the format i have given example - from field "time":"2020-12-04+01:00" , if i want to extract only 2020-12-04 then how can i do that?

Re: how to extract date using rex?

Kumar2 — Thu, 30 Dec 2021 10:49:51 GMT

@gcusello Hi sir How to write rex command for this extracting this fields into date and file

Jan 22 06:53 | 21361MA54268.done

Can you please help me .Thanks in Advance

Re: how to extract date using rex?

gcusello — Thu, 30 Dec 2021 11:06:58 GMT

Hi @avneet26,
if you want to extarct the "Time" field, you can use a regex:

| rex "\"time\":\"(?<time>\d+-\d+-\d+)"

if instead you want to use it as event timestamp, you have to put in your props.conf:

[your_sourcetype] TIME_PREFIX = \"time\":\" TIME_FORMAT = %Y-%m-%d

Ciao.

Giuseppe

Re: how to extract date using rex?

gcusello — Thu, 30 Dec 2021 11:10:51 GMT

Hi @Kumar2,

if you want to extarct the "Time" field, you can use a regex:

| rex "^(?<time>[^\|]+)"

if instead you want to use it as event timestamp, you have to put in your props.conf:

[your_sourcetype] TIME_PREFIX = ^ TIME_FORMAT = %b %d %H:%M

Ciao.

Giuseppe

Re: how to extract date using rex?

Kumar2 — Thu, 30 Dec 2021 12:42:35 GMT

Thank you sir

Re: how to extract date using rex?

gcusello — Fri, 31 Dec 2021 07:25:09 GMT

Hi @Kumar2,

good for you, see next time.

eventually, next time, open a new question, even if similar to another, so you can accept the answer for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉