All Apps and Add-ons

REGEX for separate DATE and TIME

chamil3001
Explorer

Hi,

I have this log file with

Start date and time 2/27/2011 11:44:02 PM

End date and time 3/28/2011 11:56:56 PM

I need to extract the Fields as follows. START_DATE,START_TIME and END_DATE,END_TIME.

My IFX regex (?i)^(?:[^\t]\t){10}(?P[^ ]+)* will select the date but how to
separate the START_DATE and END_DATE with REGEX?

Please drop me some examples..
Thanks in advance

Chamil

0 Karma

eashwar
Communicator

find your the sourcetype associated with the log in splunk/etc/apps/your app name(search or any custom app)/local/props.conf

[yoursourcetype]  
EXTRACT-startdatetime=(?i)Start\sdate\sand\stime\s(?P<StartDate>\d{1,2}/\d{1,2}/\d{1,4})\s+(?P<StartTime>\d{1,2}:\d{1,2}:\d{1,2}\s\S{2})
EXTRACT-enddatetime=(?i)End\sdate\sand\stime\s(?P<EndDate>\d{1,2}/\d{1,2}/\d{1,4})\s+(?P<EndTime>\d{1,2}:\d{1,2}:\d{1,2}\s\S{2})

append the two lines(EXTRACT) under your sourcetype name, be very careful and make sure that the EVENTS sourcetype matches the one inside the square brackets. If you cant find just create one with the values.

make sure you also check the props.conf in splunk/etc/system/local/ and splunk/user/admin(or your username)/appname(search or custom app)/local/

if you still have some problem
comment.. i will help you.
happy splunking!!!

0 Karma

eashwar
Communicator

hey NVM,
consider voting if it helped you.
thanks, happy splunking

0 Karma

chamil3001
Explorer

thank you very much.. appreciate it

0 Karma

bmacias84
Champion

Ok I am familar with this type of Log(OFX mostly). Currently are those two lines one event or two? Does every event in your logs start that way?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What does the entire event look like?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...