topic Re: Extract date and time in Splunk Search

Extract date and time

Devi13 — Thu, 22 Feb 2024 09:36:12 GMT

Hello Team,

I need help in extracting the following date and time from the log,
sample log: -0900, 04.25.01 THU 22FEB24 nDD62320I

I need the 04.25.01 THU 22FEB24 part, could someone please help in extracting this using rex

Any help is much appreciated

Re: Extract date and time

jotne — Thu, 22 Feb 2024 09:54:30 GMT

Some like this:

,\s(\d\d\.\d\d\.\d\d\s\w+\s\d+\w+\d\d)\s

Or do you like to do it props.conf to set the _time field?

TIME_FORMAT = %z, %T %a %d%b%y

Try it out here: https://strftime.net/

Re: Extract date and time

Devi13 — Thu, 22 Feb 2024 12:33:16 GMT

Thank you so much, worked like a charm

Re: Extract date and time

Devi13 — Fri, 01 Mar 2024 09:35:23 GMT

hii,

it worked fine till February but for some reason the date is not getting extracted for March.

Could you please help here

want the date extracted for all the months..as the day goes by

Re: Extract date and time

Devi13 — Fri, 01 Mar 2024 09:44:16 GMT

Hello @jotne ,

this is the regex: | rex field=_raw (?<date>\s(\d\d\.\d\d\.\d\d\s\w+\s\d+\w+\d\d)\s)

Re: Extract date and time

jotne — Fri, 01 Mar 2024 09:48:03 GMT

I guess the first 9 days in every month has just one digit. This should do:

,\s(\d\d\.\d\d\.\d\d\s\w+\s+\d+\w+\d\d)\s

Added a + behind a space since it may be more than one space

TIME_FORMAT = %z, %T %a %e%b%y

Change a %d to %e

Re: Extract date and time

Devi13 — Fri, 01 Mar 2024 09:47:32 GMT

Thank you so much for your great help 🙂

Re: Extract date and time

isoutamo — Fri, 01 Mar 2024 09:55:22 GMT

as @jotne has used %z as time zone information on props.conf you should add also this to your regex and then if/when needed use strptime and strftime functions to convert that field as needed. On ingestion time that happened automatically with correct TIME* definitions.

r. Ismo