https://community.splunk.com/t5/Splunk-Search/Extract-Hostname-Date-and-time-from-the-log/m-p/432753#M123659 <P>Hi all</P> <P>I want to extract Hostname, date and time from the log, Kindly help</P> <P>sample log:<BR /> Mar 12 09:13:46 hostname1 &lt;118&gt;1 2019-03-12T09:13:46.743+00:00 ip.address</P> <P>Hostname Date Time<BR /> hostname1 2019-03-12 09:13:46</P> Fri, 15 Mar 2019 02:14:21 GMT paullt12345 2019-03-15T02:14:21Z https://community.splunk.com/t5/Splunk-Search/Extract-Hostname-Date-and-time-from-the-log/m-p/432753#M123659 <P>Hi all</P> <P>I want to extract Hostname, date and time from the log, Kindly help</P> <P>sample log:<BR /> Mar 12 09:13:46 hostname1 &lt;118&gt;1 2019-03-12T09:13:46.743+00:00 ip.address</P> <P>Hostname Date Time<BR /> hostname1 2019-03-12 09:13:46</P> Fri, 15 Mar 2019 02:14:21 GMT https://community.splunk.com/t5/Splunk-Search/Extract-Hostname-Date-and-time-from-the-log/m-p/432753#M123659 paullt12345 2019-03-15T02:14:21Z https://community.splunk.com/t5/Splunk-Search/Extract-Hostname-Date-and-time-from-the-log/m-p/432754#M123660 <P>Hi @paullt12345</P> <P>Try like</P> <PRE><CODE>| makeresults | eval log="Mar 12 09:13:46 hostname1 &lt;118&gt;1 2019-03-12T09:13:46.743+00:00 ip.address" | rex field=log ":\d{2}\s+(?P&lt;Hostname&gt;.+)\s+&lt;.*(?P&lt;Date&gt;\d{4}\-\d{2}\-\d{2})T(?P&lt;Time&gt;\d{2}\:\d{2}\:\d{2})" </CODE></PRE> Fri, 15 Mar 2019 02:16:40 GMT https://community.splunk.com/t5/Splunk-Search/Extract-Hostname-Date-and-time-from-the-log/m-p/432754#M123660 vnravikumar 2019-03-15T02:16:40Z https://community.splunk.com/t5/Splunk-Search/Extract-Hostname-Date-and-time-from-the-log/m-p/432755#M123661 <P>it works.. thanks..</P> Fri, 15 Mar 2019 02:19:27 GMT https://community.splunk.com/t5/Splunk-Search/Extract-Hostname-Date-and-time-from-the-log/m-p/432755#M123661 paullt12345 2019-03-15T02:19:27Z