https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-date-time-field-from-my-sample-data-using/m-p/283059#M85536 <P>Tested this and works fine:</P> <PRE><CODE>conn | rex field=_raw "^(?P\w+\s+\d+\s+\d+:\d+:\d+)" | stats count by ddate </CODE></PRE> Thu, 28 Jul 2016 08:48:25 GMT inventsekar 2016-07-28T08:48:25Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-date-time-field-from-my-sample-data-using/m-p/283058#M85535 <P>I used this search, but it is not extracting the date time field properly. I will use this date time as a common field to join openstack api to find a public ip.</P> <PRE><CODE>"conn" | rex field=_raw "(?P...\d+\d+:\d+:\d+)" </CODE></PRE> <P>2nd try, also no result:</P> <PRE><CODE>"conn" | rex field=_raw "(?P\[\s*(\d+/\D+/.*?)\])" | stats count by ddate </CODE></PRE> <P>Sample event:</P> <PRE><CODE>Jul 28 09:52:47 icns02 slapd[17684]: conn=1228614 fd=22 closed </CODE></PRE> Thu, 28 Jul 2016 07:11:21 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-date-time-field-from-my-sample-data-using/m-p/283058#M85535 cyberportnoc 2016-07-28T07:11:21Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-date-time-field-from-my-sample-data-using/m-p/283059#M85536 <P>Tested this and works fine:</P> <PRE><CODE>conn | rex field=_raw "^(?P\w+\s+\d+\s+\d+:\d+:\d+)" | stats count by ddate </CODE></PRE> Thu, 28 Jul 2016 08:48:25 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-date-time-field-from-my-sample-data-using/m-p/283059#M85536 inventsekar 2016-07-28T08:48:25Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-date-time-field-from-my-sample-data-using/m-p/283060#M85537 <P>May I know if that rex on my reply worked fine or not. </P> Thu, 28 Jul 2016 16:55:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-date-time-field-from-my-sample-data-using/m-p/283060#M85537 inventsekar 2016-07-28T16:55:26Z