topic How to extract a date from a string? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354744#M104980 <P>Hi,</P> <P>I have a string <BR /> 'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv'</P> <P>How do I extract '2017-05-12' from 'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv' in my saved search?</P> Tue, 29 Sep 2020 14:30:35 GMT rmuraly 2020-09-29T14:30:35Z How to extract a date from a string? https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354744#M104980 <P>Hi,</P> <P>I have a string <BR /> 'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv'</P> <P>How do I extract '2017-05-12' from 'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv' in my saved search?</P> Tue, 29 Sep 2020 14:30:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354744#M104980 rmuraly 2020-09-29T14:30:35Z Re: How to extract a date from a string? https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354745#M104981 <P>You might have to add mocked up raw data and also your search for us to help you better. However, based on what you have provided please try following regular expression:</P> <PRE><CODE>| rex field=_raw "_(?&lt;Date&gt;\d{4}-\d{2}-\d{2})_" | table Date _raw </CODE></PRE> Thu, 15 Jun 2017 19:04:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354745#M104981 niketn 2017-06-15T19:04:42Z Re: How to extract a date from a string? https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354746#M104982 <P>If this string is part of an already extracted field, say file_path, then in rex command, use file_path instead of _raw.</P> Tue, 29 Sep 2020 14:28:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354746#M104982 somesoni2 2020-09-29T14:28:07Z Re: How to extract a date from a string? https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354747#M104983 <P>I had to extract the date from my source file and this helps me do it.</P> <P>| stats count | eval source="ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv"| rex field=source"<EM>(?\d{4}-\d{2}-\d{2})</EM>"<BR /> | table Date,source</P> <P>Thank you</P> Tue, 29 Sep 2020 14:30:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354747#M104983 rmuraly 2020-09-29T14:30:38Z Re: How to extract a date from a string? https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354748#M104984 <P>I had to extract the date from my source file and this helps me do it.</P> <P>| stats count | eval source="ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv"| rex field=source"(?\d{4}-\d{2}-\d{2})"<BR /> | table Date,source</P> <P>Thank you</P> Tue, 29 Sep 2020 14:30:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354748#M104984 rmuraly 2020-09-29T14:30:40Z Re: How to extract a date from a string? https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354749#M104985 <P>@rmuraly, I have converted my comment as answer. Please accept to mark the question as answered.</P> Thu, 15 Jun 2017 19:43:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-date-from-a-string/m-p/354749#M104985 niketn 2017-06-15T19:43:11Z