topic Re: How to transfer Strftime TIME_FORMAT to a regular expression ? in Splunk Search

How to transfer Strftime TIME_FORMAT to a regular expression ?

royimad — Mon, 28 Sep 2020 13:37:40 GMT

Log content (log4j) begin with a date that i will use it as TIME_FORMAT in my props.conf file.

Fri Jan 04 2013 13:05:34,114 EST ERROR wavemark.webapp.interceptors.WmExceptionInterceptor - WaveMarkException occurred
wavemark.common.exceptions.WaveMarkException: Error while calling method [getReportData] in deleg

The TIME_FORMAT should be equal to %a %b %e %Y %k:%M:%S,%3 %Z
I need to convert this to the regular expression to put it on LINE_BREAKER.

So what are the equivalent of my strftime in regular expression? is their a tool to convert this or i just need it to write it from scratch.

Many Thanks,
Roy

Re: How to transfer Strftime TIME_FORMAT to a regular expression ?

gfuente — Wed, 27 Mar 2013 16:46:27 GMT

Hello

Try this regex:

\w{3}\s\w{3}\s\d{2}\s\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s\w{3}

Regards

Edited to add miliseconds and time zone, hope it works

Re: How to transfer Strftime TIME_FORMAT to a regular expression ?

royimad — Wed, 27 Mar 2013 16:54:17 GMT

How to add the rest of the date the millisecond and the timezone ?

Re: How to transfer Strftime TIME_FORMAT to a regular expression ?

gfuente — Wed, 27 Mar 2013 17:03:33 GMT

Done let me know it works