Dashboards & Visualizations

how can i extract date only from date field?

avneet26
Engager

hi , the format of the field is "errorOccuredOn":"2020-12-04+01:00" and i want to extract only the date i.e. only 2020-12-04 should be coming into the result. Let me know how this can be achieved.

0 Karma

avneet26
Engager

thanks it worked!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @avneet26,

if you already have the field  errorOccuredOn and you need only to extract the date, you can use this regex:

| rex  field=errorOccuredOn "^(?<errorOccuredOn>\d+-\d+-\d+)"

If instead you have to extract the field from the raw data, you can use the following regex

| rex "\"errorOccuredOn\":\"(?<errorOccuredOn>\d+-\d+-\d+)"

that you can test at https://regex101.com/r/CRiDtQ/1

Sorry, but did you open a new question instead continue the old one?

Ciao.

Giuseppe

0 Karma

493669
Super Champion

@avneet26 you can use substr command-

|eval errorOccuredOn=substr(errorOccuredOn,1,10)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...