topic Re: how to take timestamp from this in Splunk Search

how to take timestamp from this

gajananh999 — Tue, 10 Jun 2014 08:50:54 GMT

Dear all,

I need your help to how to remove timestamp from this field.

2014-05-19T03:25:26.000-04:00

There is TO word in this so i want to remove that and remove the last -04:00 also.

Can anybody help me on this on regular expression?

Thanks

Gajanan Hiroji

Re: how to take timestamp from this

lcrielaa — Tue, 10 Jun 2014 11:07:19 GMT

Depends on what you're looking for but here's some examples:

Regex capture group for date and time

^(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2}:\d{2}\.\d{3})-\d{2}:\d{2}

Splunk rex command for extracting date and time

| rex field=_raw ^(?<Date>\d{4}-\d{2}-\d{2})T(?<Time>\d{2}:\d{2}:\d{2}\.\d{3})-\d{2}:\d{2}

In props.conf, you'll want something like TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N

Also, there isn't a word "TO" in there, it's just the letter T and the zero. It's not the letter O.

Re: how to take timestamp from this

gajananh999 — Tue, 10 Jun 2014 11:26:29 GMT

But when i try to do field extract with the same Regex it shows Regex does not extract any named fields. I tried removing last part of regex that is -\d{2}:\d{2} because it was not required for me. Am I going wrong somewhere?

Re: how to take timestamp from this

gajananh999 — Tue, 10 Jun 2014 12:11:53 GMT

This is my log file

Timestamp   Event
5/22/14 10:32:15.000 AM [2014-05-22T05:02:15.000+00:00] [oracle] [NOTIFICATION:1] [] [] [ecid: 00^sq] [tid: 1604]  [36007] Loading repository.

Here it show Timestamp 5/22/14 10:32:15.000 AM But the actual timestamp is 2014-05-22T05:02:15.000+00:00 which should be 5/22/14 05:02:15.000 AM exactly 5.30 hours it is increasing for all the event what may be the reason behind this?

Thanks

Gajanan Hiroji

Re: how to take timestamp from this

gajananh999 — Tue, 10 Jun 2014 12:12:01 GMT

This is my log file

Timestamp   Event
5/22/14 10:32:15.000 AM [2014-05-22T05:02:15.000+00:00] [oracle] [NOTIFICATION:1] [] [] [ecid: 00^sq] [tid: 1604]  [36007] Loading repository.

Thanks

Gajanan Hiroji