Getting Data In

How to extract date from a field name in a csv file?

sc0tt
Builder

I'm struggling with extracting a date value from a field name in a csv file. I have a field named "Status for 2014-28-07". I want to extract the date portion of the field name in order to determine if the file was generated for the current date. I know that having a separate date field would simplify things, but this is how the file is generated.

What's the best way to do this?

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Take a look at this run-anywhere example:

| stats count | eval "Status for 2014-28-07" = "foo" | foreach "Status for 20*" [eval date = "20<<MATCHSTR>>"]

Result:

Status for 2014-28-07   date
foo                     2014-28-07

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Take a look at this run-anywhere example:

| stats count | eval "Status for 2014-28-07" = "foo" | foreach "Status for 20*" [eval date = "20<<MATCHSTR>>"]

Result:

Status for 2014-28-07   date
foo                     2014-28-07

sc0tt
Builder

Brilliant! Just what I needed.

0 Karma

sc0tt
Builder

It is the column header. For example:
Id, Status for 2014-28-07
01, active
02, inactive

0 Karma

strive
Influencer

Is this column header OR a value in a column. If it is value in a column then what is the column header name.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...