topic Re: use multiple numbers at search in Splunk Search

How to use multiple numbers in search?

ipteam — Mon, 23 Jan 2023 19:21:26 GMT

Hello Guys,

I'd like to create a search based on business hours, and like to use a field with value like this:

"2023/01/20 08:52:58"

The bold number would be interesting, and like to search with multiple values. example 08-18h [08,09,10,11,12,13,14,15,16,17,18]

How could I find a regex to extract theese numbers?

thanks a lot!

Re: use multiple numbers at search

PaulPanther — Mon, 23 Jan 2023 15:56:18 GMT

@ipteam You shouldn't need a field extraction. Splunk parses the timestamp into multiple fields like date_hour.

Sample search:

index=_internal | where date_hour>07 AND date_hour<19

Re: use multiple numbers at search

ipteam — Mon, 23 Jan 2023 16:34:56 GMT

Yes, would be great, but this filed is not equal to the generated time of the log. Unfortunatly it's a custom one.
Also interested in the regex what splits _time filed to day,hour.. and so on.

Re: use multiple numbers at search

jamie00171 — Mon, 23 Jan 2023 19:09:20 GMT

Hi @ipteam,

Something like this should work for you:

<your search goes here>
| rex field=<insert field name that contains timestamp here> "(?<year>\d{4})\/(?<month>\d{2})\/(?<day>\d{2})\s+(?<hour>\d{2})\:(?<minutes>\d{2})\:(?<seconds>\d{2})"

Thanks,

Jamie

Re: use multiple numbers at search

PickleRick — Mon, 23 Jan 2023 21:38:28 GMT

Those time fields are tricky because:

1) They might not get extracted at all

2) They represent the timestamp parts as included in the raw event. So if the original event included some exotic timezone, those fields will be in that timezone.

Re: use multiple numbers at search

ipteam — Tue, 24 Jan 2023 07:53:04 GMT

Hello Jamie,

Works, thanks a lot!