topic Re: Please help with Date extraction from below string in Splunk Search

Please help with Date extraction from below string

bhaskar5428 — Thu, 24 Mar 2022 07:13:14 GMT

i have system column "_time" with below output

2022-03-16 11:12:18.723

i would like segregate date and time by rex command

output should be like this with new column name

Date = 2022-03-16

Time = 11:12:18

Re: Please help with Date extraction from below string

gcusello — Thu, 24 Mar 2022 07:54:41 GMT

Hi @bhaskar5428,

let me understand: are you spoeaking of search time extraction or timestamp configuration?

if search time extraction, you could use a regex like this:

| rex "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d"

Ciao.

Giuseppe

Re: Please help with Date extraction from below string

ITWhisperer — Thu, 24 Mar 2022 07:57:00 GMT

If it is already in the _time field, it is probably already in epoch time format, so try this

| eval Date=strftime(_time,"%F") | eval Time=strftime(_time,"%T")

Re: Please help with Date extraction from below string

bhaskar5428 — Thu, 24 Mar 2022 08:15:34 GMT

index=app_events_fx4cash_uk_prod source=*STPManager-servicemanagement.20220316-111218.log*
| rex field=_time "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d"
| table date,time

am using this but getting error

Error in 'rex' command: Encountered the following error while compiling the regex '^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d': Regex: missing closing parenthesis.

The search job has failed due to an error. You may be able view the job in the

Re: Please help with Date extraction from below string

gcusello — Thu, 24 Mar 2022 08:23:43 GMT

Hi @bhaskar5428,

sorry I missed a paranthesi at the end of the regex, please try this:

| rex field=_time "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d)"

Ciao.

Giuseppe

Re: Please help with Date extraction from below string

bhaskar5428 — Thu, 24 Mar 2022 08:26:47 GMT

Thanks , it worked