https://community.splunk.com/t5/Splunk-Search/regex-to-extract-date-from-the-file-name/m-p/279568#M84470 <P>Sample Event :</P> <PRE><CODE>Fri Apr 8 18:20:42 2016 action=add, path="/ubidata/axway/JourneyData/AAA_NA_712_2016-03-28-21-19-03_354235057942819_1G1ZT64885F132289_0_0.zip", isdir=0, size=18443, gid=0, uid=0, modtime="Fri Apr 8 18:20:41 2016", mode="rw-r--r--", hash= </CODE></PRE> Sat, 09 Apr 2016 01:53:32 GMT athorat 2016-04-09T01:53:32Z https://community.splunk.com/t5/Splunk-Search/regex-to-extract-date-from-the-file-name/m-p/279567#M84469 <P>Hi</P> <P>we are using fs_notification and monitoring a specific path.<BR /> I have a field called path which has the following values. <BR /> Now I have to extract the date from the name of the file which is 2016-03-28 for the following files and then do a count of those values.</P> <PRE><CODE> /ubidata/axway/JourneyData/AAA_NA_70_2016-03-28-03-30-07_353466071554972_NA_0_0.zip /ubidata/axway/JourneyData/AAA_NA_70_2016-03-28-00-47-08_353466071286872_1HGCR2F5XDA159398_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-23-38-13_353466070336173_5J6YH28776L027013_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-23-11-04_353466070738055_JHMES96664S000240_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-22-23-29_353466070290842_1FTRW12557FB57292_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-20-36-26_354235059078372_1GNDV23LX6D194324_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-20-31-06_354235059637177_JTDBR32E170131585_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-20-27-01_354235059626014_2GKFLSE39D6131090_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-20-14-59_354235059651772_3FAHP06Z48R221560_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-20-08-00_354235057942819_1G1ZT64885F132289_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-19-50-45_354235058343207_JHLRM3H51CC010877_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-19-20-32_353466070121963_1J4FT28B19D178678_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-18-23-14_354235059577712_5FNYF28407B037209_0_0.zip </CODE></PRE> Sat, 09 Apr 2016 01:29:23 GMT https://community.splunk.com/t5/Splunk-Search/regex-to-extract-date-from-the-file-name/m-p/279567#M84469 athorat 2016-04-09T01:29:23Z https://community.splunk.com/t5/Splunk-Search/regex-to-extract-date-from-the-file-name/m-p/279568#M84470 <P>Sample Event :</P> <PRE><CODE>Fri Apr 8 18:20:42 2016 action=add, path="/ubidata/axway/JourneyData/AAA_NA_712_2016-03-28-21-19-03_354235057942819_1G1ZT64885F132289_0_0.zip", isdir=0, size=18443, gid=0, uid=0, modtime="Fri Apr 8 18:20:41 2016", mode="rw-r--r--", hash= </CODE></PRE> Sat, 09 Apr 2016 01:53:32 GMT https://community.splunk.com/t5/Splunk-Search/regex-to-extract-date-from-the-file-name/m-p/279568#M84470 athorat 2016-04-09T01:53:32Z https://community.splunk.com/t5/Splunk-Search/regex-to-extract-date-from-the-file-name/m-p/279569#M84471 <P>I'm definitely not the best with regex, but maybe something like this?</P> <PRE><CODE>rex field=path "\_\w+\_(?&lt;date&gt;\w+-\w+-\w+)" </CODE></PRE> Sat, 09 Apr 2016 03:09:08 GMT https://community.splunk.com/t5/Splunk-Search/regex-to-extract-date-from-the-file-name/m-p/279569#M84471 niemesrw 2016-04-09T03:09:08Z https://community.splunk.com/t5/Splunk-Search/regex-to-extract-date-from-the-file-name/m-p/279570#M84472 <P>This should get you the <CODE>date</CODE></P> <PRE><CODE>rex "_(?&lt;date&gt;\d{4}-\d{2}-\d{2})-" </CODE></PRE> Sat, 09 Apr 2016 14:31:24 GMT https://community.splunk.com/t5/Splunk-Search/regex-to-extract-date-from-the-file-name/m-p/279570#M84472 sundareshr 2016-04-09T14:31:24Z