topic Re: How to edit my regular expression to extract the date and time from my sample data? in Splunk Search

How to edit my regular expression to extract the date and time from my sample data?

dbcase — Fri, 09 Sep 2016 22:02:03 GMT

Hi,

I have data that looks like this:

"-" 10.30.28.1 "10.30.28.1" - - [09/Sep/2016:16:58:31 -0500] "GET /ICHealthCheck/serverstatus HTTP/1.0" 200 2 0 UCT-11666 "-" "-" "-"

And I'm trying to write a regular expression that extracts several fields:

So far I have:

(?P<host>[^"]+)[^ \n]* (?P<remote_host>[^ ]+)\s+(?P<x_forwarded_for>[^ ]+)\s+(?P<remote_logname>[^ ]+)\s+(?P<remote_user>\-)\s+

And this works, but I'm stuck at extracting the date and time 09/Sep/2016:16:58:31 in this case. The [ is throwing me off.

Re: How to edit my regular expression to extract the date and time from my sample data?

sundareshr — Fri, 09 Sep 2016 22:10:39 GMT

For Date & Time, this should work. Also I would not recommend creating one big regex, even if one character position changes, your fields will not be exractracted and will become very difficult to debug. I would recommend treating this as a space delimited in field extraction UI (IFX). Regardless, for date/time, you need to escape the [ & ] chars. Like this

\[(?<datetime>[^\s]+)

Re: How to edit my regular expression to extract the date and time from my sample data?

dbcase — Fri, 09 Sep 2016 22:15:41 GMT

Thanks Sundareshr! Maybe a space delimited extraction is the way to go. Let me try that instead.