How can I use Regrex Command to split string?

ichesla1111 — Wed, 01 Feb 2023 17:30:04 GMT

Hello!

I am caluclating utilization (already done), but I want to fix my event start times.

The start time for a run on a machine is located in the filename, but I am having difficulty doing the regrex command and understanding how it works.

ex. Filename String:

013023-123141-46.xml

Step1: Extract middle string (highlighted in red):

013023-123141-46.xml -->WANT: "123141"

Step2: Add ":" between every other number (highlighted in red):
"123141" --> Final string: "12:31:41"

Step3: Convert time string "12:31:41" into a time stamp:
Field: Starttime = strftime(Start_Time,"%h:%m:%s")

Re: Regrex Command to split string

gcusello — Wed, 01 Feb 2023 16:06:23 GMT

Hi @ichesla1111,

please try something like this:

<your_search> | rex field=filename "^\d+-(?<hh>\d\d)(?<mm>\d\d)(?<ss>\d\d)" | eval Starttime = hh.":".mm.":".ss | table Starttime

you can test the regex at https://regex101.com/r/8mQ7WB/1

Ciao.

Giuseppe

topic Re: Regrex Command to split string in Dashboards & Visualizations

How can I use Regrex Command to split string?

Re: Regrex Command to split string