Dashboards & Visualizations

How to extract Date from Day format

aditsss
Motivator

Hi All,

I have one field Rundatetime which is in below format:

10/25/2020 3:57

10/16/2020 5:22

I just want to extract Date from it as below:

10/25/2020

10/16/2020

How can I do that. Can someone guide me

My current query is this:

| inputlookup mnr_rally_defects2.csv| table Rundatetime 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

for this reason I hinted to use rex instead substr!

Try again with my rex hint.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

you can use the solution of @termcap, that surely works, or the following regex:

 

| rex field=Rundatetime "^(?<date>[^ ]+)"

 

Ciao.

Giuseppe 

0 Karma

aditsss
Motivator

@gcusello 

I am not getting all the dates correct :

1/8/2021 3:
1/9/2021 3:
10/16/2020
10/17/2020
10/20/2020
10/25/2020
10/27/2020
11/14/2020
11/17/2020
11/18/2020
12/2/2020 3
12/24/2020
12/30/2020

 

Getting some values like below.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

for this reason I hinted to use rex instead substr!

Try again with my rex hint.

Ciao.

Giuseppe

aditsss
Motivator

@gcusello 

I used like  this:

 

| inputlookup mnr_rally_defects1.csv| rex field=rundatetime "?(?<date>[^ ]+)"| table date

getting below error:

Error in 'rex' command: Encountered the following error while compiling the regex '?(?<date>[^ ]+)': Regex: quantifier does not follow a repeatable item.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

sorry!

there was a typing error, please try this:

| rex field=Rundatetime "^(?<date>[^ ]+)"

Ciao.

Giuseppe

0 Karma

termcap
Path Finder

 

| inputlookup mnr_rally_defects2.csv| eval date_today=substr(Rundatetime ,1,11)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...