https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429532#M172511 <P>Hi</P> <P>Try like</P> <PRE><CODE>yourquery|rex field=msg "_\d{3}(?P&lt;date&gt;\d{4}.+)" </CODE></PRE> <P>or</P> <PRE><CODE>yourquery|rex field=msg "\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}$" </CODE></PRE> Tue, 12 Mar 2019 14:42:17 GMT vnravikumar 2019-03-12T14:42:17Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429528#M172507 <P>Hi Team,</P> <P>I have the following field values and i want extract only the highlighted values from it.</P> <PRE><CODE>utility_extract10_DELTA_708**2019-03-12 06:03:33** utility_extract1_DELTA_708**2019-03-12 06:06:27** </CODE></PRE> <P>Can you please give me a solution to this?</P> Tue, 12 Mar 2019 14:23:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429528#M172507 pench2k19 2019-03-12T14:23:33Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429529#M172508 <P>Can you specify the required text</P> Tue, 12 Mar 2019 14:27:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429529#M172508 vnravikumar 2019-03-12T14:27:39Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429530#M172509 <P>2019-03-12 06:03:33<BR /> 2019-03-12 06:06:27</P> Tue, 12 Mar 2019 14:38:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429530#M172509 pench2k19 2019-03-12T14:38:02Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429531#M172510 <P>actual field values are like below</P> <P>utility_extract10_DELTA_7082019-03-12 06:03:33<BR /> utility_extract1_DELTA_7082019-03-12 06:06:27</P> <P>i want to extract </P> <P>2019-03-12 06:03:33<BR /> 2019-03-12 06:06:27 respectively</P> Tue, 29 Sep 2020 23:37:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429531#M172510 pench2k19 2020-09-29T23:37:06Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429532#M172511 <P>Hi</P> <P>Try like</P> <PRE><CODE>yourquery|rex field=msg "_\d{3}(?P&lt;date&gt;\d{4}.+)" </CODE></PRE> <P>or</P> <PRE><CODE>yourquery|rex field=msg "\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}$" </CODE></PRE> Tue, 12 Mar 2019 14:42:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429532#M172511 vnravikumar 2019-03-12T14:42:17Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429533#M172512 <P>no this is not working for all the values...i have 22 values for msg field before apply this rex, but after i apply its showing only 20 values...for 2 values the regex is not appropriate..</P> <P>Posting here few more values from that value</P> <P>utility_extract10_DELTA_7082019-03-12 06:03:33<BR /> utility_extract10_DELTA_9362019-03-12 06:07:00<BR /> utility_extract11_DELTA_7082019-03-12 06:08:17<BR /> utility_extract11_DELTA_9362019-03-12 06:07:35<BR /> utility_extract12_DELTA_7082019-03-12 06:08:39<BR /> utility_extract13_DELTA_7082019-03-12 06:08:40<BR /> utility_extract13_DELTA_9362019-03-12 06:10:21<BR /> utility_extract14_DELTA_7082019-03-12 06:09:52<BR /> utility_extract1_DELTA_7082019-03-12 06:06:27<BR /> utility_extract1_DELTA_9362019-03-12 06:06:51</P> <P>i just neeed to extract the date and time from that field</P> Tue, 29 Sep 2020 23:37:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429533#M172512 pench2k19 2020-09-29T23:37:14Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429534#M172513 <P>@pench2k19 You can use the below rex command , suppose your field name is x</P> <PRE><CODE> &lt;your query&gt;|rex field=x "_\d+.*(?P&lt;date&gt;\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2})" </CODE></PRE> Tue, 12 Mar 2019 14:58:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429534#M172513 Vijeta 2019-03-12T14:58:07Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429535#M172514 <P>no luck..its still missing 2 values before and after we apply rex expression</P> Tue, 12 Mar 2019 15:01:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429535#M172514 pench2k19 2019-03-12T15:01:24Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429536#M172515 <P>hi @pench2k19 </P> <PRE><CODE> |rex "\*?(?P&lt;my_time&gt;\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})\*?" max_match=0 </CODE></PRE> <P>This will give you a new field called 'my_time' with just your extracted date.</P> <P>This should work, given your source data: see <A href="https://regex101.com/r/hZQsA9/2">https://regex101.com/r/hZQsA9/2</A></P> Tue, 12 Mar 2019 15:01:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429536#M172515 nickhills 2019-03-12T15:01:41Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429537#M172516 <P>no luck with this as well.</P> <P>as i said in my previous comments i have 22 values like the follwoing in one field</P> <P>utility_extract10_DELTA_7082019-03-12 06:03:33<BR /> utility_extract10_DELTA_9362019-03-12 06:07:00<BR /> utility_extract11_DELTA_7082019-03-12 06:08:17<BR /> utility_extract11_DELTA_9362019-03-12 06:07:35<BR /> utility_extract12_DELTA_7082019-03-12 06:08:39<BR /> utility_extract13_DELTA_7082019-03-12 06:08:40<BR /> utility_extract13_DELTA_9362019-03-12 06:10:21<BR /> utility_extract14_DELTA_7082019-03-12 06:09:52<BR /> utility_extract1_DELTA_7082019-03-12 06:06:27<BR /> utility_extract1_DELTA_9362019-03-12 06:06:51</P> <P>but after i apply above regex it is giving me only 20 values result in the output, 2 values are missing</P> Tue, 29 Sep 2020 23:37:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429537#M172516 pench2k19 2020-09-29T23:37:17Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429538#M172517 <P>@pench2k19 Are you sure, I tried the below query and it resulted in appropriate date/time value in date field.</P> <PRE><CODE>|makeresults|eval x="utility_extract10_DELTA_708*2019-03-12 06:03:33"| appendpipe[|eval x="utility_extract1_DELTA_7082019-03-12 06:06:27*"]|rex field=x "_\d+.*(?P&lt;date&gt;\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2})" </CODE></PRE> Tue, 12 Mar 2019 15:17:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429538#M172517 Vijeta 2019-03-12T15:17:08Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429539#M172518 <P>If possible can you please post that two msg that was missing</P> Tue, 12 Mar 2019 15:29:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429539#M172518 vnravikumar 2019-03-12T15:29:00Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429540#M172519 <P>try this rex <CODE>_.+(?P&lt;date&gt;\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})</CODE></P> Tue, 12 Mar 2019 15:38:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429540#M172519 vnravikumar 2019-03-12T15:38:27Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429541#M172520 <P>Have you tried?</P> Tue, 12 Mar 2019 16:28:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-a-few-characters-at-the-beginning-of-a-field/m-p/429541#M172520 vnravikumar 2019-03-12T16:28:19Z