topic How to use regex to extract date? in Splunk Search

How to use regex to extract date?

kirangurram — Thu, 25 Apr 2019 11:28:13 GMT

Hello experts , I need some help in extracting date time from the attribute "SrcDtm" in below sample data.

<GI SrcDtm="2019-04-18T18:23:47Z" SrcTmOff="-07:00" SrcAppCd="ABC" SrcCtryCd="IN" SrcFcId="ABCABC" SrcSrvaCd="ABC" SrcFcCd="ABC" CorrId="469429d1-00cd-49a3-906f-fce27fdb4d0c" />

Re: How to use regex to extract date?

FrankVl — Thu, 25 Apr 2019 11:45:20 GMT

Do you already have those key value pairs extracted as fields? If so, you don't need a rex, just a conversion to timestamp:

| eval DateTime = strptime(SrcDtm,"%Y-%m-%dT%H:%M:%SZ")

If you have not extracted key value pairs yet, rex would be one way to do that:

| rex "SrcDtm=\"(?<SrcDtm>[^\"]+)\""
| eval DateTime = strptime(SrcDtm,"%Y-%m-%dT%H:%M:%SZ")

Re: How to use regex to extract date?

woodcock — Fri, 26 Apr 2019 04:45:48 GMT

Like this:

... | rex "SrcDtm=\"(?<SrcDtm>[^\"]+)"