All Apps and Add-ons

REGEX for separate DATE and TIME

chamil3001
Explorer

Hi,

I have this log file with

Start date and time 2/27/2011 11:44:02 PM

End date and time 3/28/2011 11:56:56 PM

I need to extract the Fields as follows. START_DATE,START_TIME and END_DATE,END_TIME.

My IFX regex (?i)^(?:[^\t]\t){10}(?P[^ ]+)* will select the date but how to
separate the START_DATE and END_DATE with REGEX?

Please drop me some examples..
Thanks in advance

Chamil

0 Karma

eashwar
Communicator

find your the sourcetype associated with the log in splunk/etc/apps/your app name(search or any custom app)/local/props.conf

[yoursourcetype]  
EXTRACT-startdatetime=(?i)Start\sdate\sand\stime\s(?P<StartDate>\d{1,2}/\d{1,2}/\d{1,4})\s+(?P<StartTime>\d{1,2}:\d{1,2}:\d{1,2}\s\S{2})
EXTRACT-enddatetime=(?i)End\sdate\sand\stime\s(?P<EndDate>\d{1,2}/\d{1,2}/\d{1,4})\s+(?P<EndTime>\d{1,2}:\d{1,2}:\d{1,2}\s\S{2})

append the two lines(EXTRACT) under your sourcetype name, be very careful and make sure that the EVENTS sourcetype matches the one inside the square brackets. If you cant find just create one with the values.

make sure you also check the props.conf in splunk/etc/system/local/ and splunk/user/admin(or your username)/appname(search or custom app)/local/

if you still have some problem
comment.. i will help you.
happy splunking!!!

0 Karma

eashwar
Communicator

hey NVM,
consider voting if it helped you.
thanks, happy splunking

0 Karma

chamil3001
Explorer

thank you very much.. appreciate it

0 Karma

bmacias84
Champion

Ok I am familar with this type of Log(OFX mostly). Currently are those two lines one event or two? Does every event in your logs start that way?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What does the entire event look like?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>