topic Re: Using regex on Extracted field in Splunk Search

Using regex on Extracted field

373782073 — Wed, 30 Sep 2020 03:36:31 GMT

Hi,
I have incoming syslog events for which I've used the Field Extraction wizard in SPLUNK to separate a the filename of the events which results in the field values look like this:

abc-servicen.City-backup-1986-01-08-16:00:43-level1.tar

I would like to eventually extract and tabulate the filename (I've called it bkp_filename when I extracted this field earlier) as well as the date YYYY-MM-DD for each filename in a separate field (call it bkp_file_date).

Can anyone suggest how to use regex or an in-built function to achieve the date extraction into a separate field or column?

Thanks

Re: Using regex on Extracted field

niketn — Thu, 09 Jan 2020 01:31:25 GMT

@373782073 is the above example the backup file name bkp_filename from which you need to extract date?

Re: Using regex on Extracted field

MuS — Thu, 09 Jan 2020 01:32:00 GMT

Hi 373782073,

Give this a try:

| makeresults 
| eval example="abc-servicen.City-backup-1986-01-08-16:00:43-level1.tar" 
| rex field=example "(?<bkp_filename>[a-zA-Z-\.]+)-(?<bkp_file_date>\d{4}-\d{2}-\d{2})"

Hope this helps ...

cheers, MuS

Re: Using regex on Extracted field

373782073 — Thu, 09 Jan 2020 01:33:12 GMT

Yes this is the field extracted which has the date embedded

Re: Using regex on Extracted field

373782073 — Thu, 09 Jan 2020 01:46:53 GMT

Great. I was able to add the rex statement to my existing search and strip the info I wanted into separate fields.
Thanks a lot!