topic Re: Date field Extraction ?? in Splunk Search

Date field Extraction ??

rakesh_498115 — Wed, 07 Nov 2012 15:01:11 GMT

Hi,

I have the following format of Dates in my logs like 2007/01/25 and 2006/12 . i want to extract these dates to a single field called Date. I have written the regular expression like this..

"(?i)/.*?/(?P\d+/\d+/\d+)/\w+"

but this is extrating only the format 2007/01/25 .. but i couldn't extract 2006/12 ..how can i write a single regular expression to extract both the dates ???

please help

Re: Date field Extraction ??

Rob — Wed, 07 Nov 2012 19:53:28 GMT

Without knowing what the source looks like, this is a bit more difficult to answer. It also looks like you are using the interactive field extractor feature in Splunk. However, the simplest regex for use with the rex command based on your example would be:

|rex field=yourField "(?<1date>[\d/]+)\s\w+"

Re: Date field Extraction ??

rakesh_498115 — Thu, 08 Nov 2012 13:52:18 GMT

I have log events like

event1

2007/02/12 <>sdsdsdsddad
asdasdasdasdsadasdasd
asdsdad

event2

2006/12 <> dasdasdasdasd
asdas
dsadsadsadsadasdasdsadsa
sadsa

Re: Date field Extraction ??

Rob — Thu, 08 Nov 2012 19:02:18 GMT

@rakesh498115
I edited the regex above to match what you are looking for. That should do the job.

Re: Date field Extraction ??

rakesh_498115 — Sat, 17 Nov 2012 13:47:30 GMT

Thanx Rob 🙂