Getting Data In

How to extract date from a field name in a csv file?

sc0tt
Builder

I'm struggling with extracting a date value from a field name in a csv file. I have a field named "Status for 2014-28-07". I want to extract the date portion of the field name in order to determine if the file was generated for the current date. I know that having a separate date field would simplify things, but this is how the file is generated.

What's the best way to do this?

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Take a look at this run-anywhere example:

| stats count | eval "Status for 2014-28-07" = "foo" | foreach "Status for 20*" [eval date = "20<<MATCHSTR>>"]

Result:

Status for 2014-28-07   date
foo                     2014-28-07

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Take a look at this run-anywhere example:

| stats count | eval "Status for 2014-28-07" = "foo" | foreach "Status for 20*" [eval date = "20<<MATCHSTR>>"]

Result:

Status for 2014-28-07   date
foo                     2014-28-07

sc0tt
Builder

Brilliant! Just what I needed.

0 Karma

sc0tt
Builder

It is the column header. For example:
Id, Status for 2014-28-07
01, active
02, inactive

0 Karma

strive
Influencer

Is this column header OR a value in a column. If it is value in a column then what is the column header name.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...