topic Re: extract date from string in Splunk Search

extract date from string

sravanthikand — Wed, 04 Jul 2018 19:35:29 GMT

Hello

I have string from nessus . Wed Jun 6 02:02:10 2018 .

I need to extract the date . strftime and strptime returns NULL.

Any ideas for rex extraction ?

I need to compare and sort the date for the last 45 days .

Thanks

MuS — Wed, 04 Jul 2018 21:02:47 GMT

Hi sravanthikand,

try this strptime() format:

| makeresults 
| eval myTime="Wed Jun 6 02:02:10 2018" 
| eval epoch_time=strptime(myTime, "%c") 
| eval _time=epoch_time

This will create a valid epoch timestamp.

Hope this helps ...

cheers, MuS

woodcock — Thu, 05 Jul 2018 02:03:52 GMT

Along with the answer from @mus, you need to make sure that you have a field myTime first. You create one like this:

| rex "(?<myTime>(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s+\S+\d+\s+\d+:\d+:\d+\s+\d+)"