topic Re: Using regex syntax to trim timestamp in Splunk Search

Using regex syntax to trim timestamp

bjs — Fri, 11 Feb 2022 20:13:47 GMT

Using regex, what is the syntax, to trim a timestamp formatted like 2022-01-06 01:51:23 UTC so that it only reflects the date and hour, like this 2022-01-06 01?

Re: Using regex syntax to trim timestamp

ITWhisperer — Fri, 11 Feb 2022 21:42:48 GMT

| rex mode=sed "s/(?<datehour>\d{4}-\d\d-\d\d \d\d)(?<discard>:\d\d:\d\d \w+)/\\1/g"

Re: Using regex syntax to trim timestamp

bjs — Fri, 11 Feb 2022 22:30:26 GMT

I was actually able to change the event timestamp by using offset: | rex field=timestamp "(?<timestamp>.{13})"

Re: Using regex syntax to trim timestamp

yuanliu — Sat, 12 Feb 2022 01:52:45 GMT

What is the use case for string manipulation if this concerns event timestamp (designated by builtin _time field)? Most of the time, using "| bin span=1h@h _time" allows better handling/flexibility down the pipe, perhaps better performance, too.

If this concerns a text field that is not used as event timestamp, an alternative to regex is split(), like

| eval date_hour = mvindex(split(timestamp, ":"), 0)

Re: Using regex syntax to trim timestamp

woodcock — Sat, 12 Feb 2022 19:37:55 GMT

Like this:

|makeresults | eval time= = 2022-01-06 01:51:23 UTC" | eval time = replace(time, "\s.*$", "")