Splunk Cloud Platform

How to extract regular expressions?

ranjithan
Path Finder

Hi ,

Need some help to extract regular expressions.

I have a set of unstructured logs . Part of the log is as shown below:

"RequestUTCDateTime":"2022-07-25T11:19:29.0106873Z"} 

How would one extract 2022-07-25T11:19:29.0106873Z   and assign it to field RequestUTCDateTime, .

This should be done whenever "RequestUTCDateTime" is encountered in the raw log.

 

Please help me.

 

Thank You,

Ranjitha N

 

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can extract the field at search-time using the rex command.

| rex "RequestUTCDateTime\\\":\\\"(?<RequestUTCDateTime>[^\\\"]+)"

Or it can be extracted automatically using an EXTRACT setting in props.conf:

EXTRACT-RequestUTCDateTime = RequestUTCDateTime":"(?<RequestUTCDateTime>[^"]+)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can extract the field at search-time using the rex command.

| rex "RequestUTCDateTime\\\":\\\"(?<RequestUTCDateTime>[^\\\"]+)"

Or it can be extracted automatically using an EXTRACT setting in props.conf:

EXTRACT-RequestUTCDateTime = RequestUTCDateTime":"(?<RequestUTCDateTime>[^"]+)
---
If this reply helps you, Karma would be appreciated.

ranjithan
Path Finder

Thank You so much for the help!

 

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...