Getting Data In

How to get the right time?

veveok
Engager

my log appear:

 

1;1;laptop-rdvt90t4;http://update-software.xxx.com/WeatherFix03_SP03120.exe;C:\Windows\SysWOW64\DynamicWeather.exe;NT AUTHORITY\SYSTEM;2022-05-02 09:23:25;192.168.1.8;;;

1;1;laptop-rdv7446p;http://update-software.xxx.com/qatherFixP00190.exe;C:\Windows\SysWOW64\Der.exe;ScWhJ\lizonghao;2022-05-02 09:25:27;192.168.1.8;;;

I use :strptime()  %H:%M:%S , and reg “202\d+-\d+\-\d+\s” to get the time,

2.jpg

 

but it look like wrong。

like this pic.

 

1.jpg

 

how to write this reg to get the  time?

 

Labels (1)
Tags (1)
0 Karma
1 Solution

veveok
Engager

it works with:

%Y-%m-%d %H:%M:%S

and

^(?:[^;]*\;){10}\s*

 

 

View solution in original post

0 Karma

veveok
Engager

it works with:

%Y-%m-%d %H:%M:%S

and

^(?:[^;]*\;){10}\s*

 

 

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...