- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SN1
Path Finder
12-12-2024
12:54 AM
hi , I want to extract from this date
12/11/2024
result should be 12/2024
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

gcusello

SplunkTrust
12-12-2024
01:04 AM
Hi @SN1 ,
if this is a field (your_field), the easiest way it to use the eval functions, not a regex:
| eval date=strftime(strptime(your_field,"%m/%d/%Y"),"%m/%Y")
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
12-12-2024
01:56 AM
Apart from what @gcusello says, rex will only extract contiguous characters into a field, so what you are asking for is not possible in a single rex command.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

gcusello

SplunkTrust
12-12-2024
01:04 AM
Hi @SN1 ,
if this is a field (your_field), the easiest way it to use the eval functions, not a regex:
| eval date=strftime(strptime(your_field,"%m/%d/%Y"),"%m/%Y")
Ciao.
Giuseppe
