Splunk Cloud Platform

How to extract regular expressions?

ranjithan
Path Finder

Hi ,

Need some help to extract regular expressions.

I have a set of unstructured logs . Part of the log is as shown below:

"RequestUTCDateTime":"2022-07-25T11:19:29.0106873Z"} 

How would one extract 2022-07-25T11:19:29.0106873Z   and assign it to field RequestUTCDateTime, .

This should be done whenever "RequestUTCDateTime" is encountered in the raw log.

 

Please help me.

 

Thank You,

Ranjitha N

 

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can extract the field at search-time using the rex command.

| rex "RequestUTCDateTime\\\":\\\"(?<RequestUTCDateTime>[^\\\"]+)"

Or it can be extracted automatically using an EXTRACT setting in props.conf:

EXTRACT-RequestUTCDateTime = RequestUTCDateTime":"(?<RequestUTCDateTime>[^"]+)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can extract the field at search-time using the rex command.

| rex "RequestUTCDateTime\\\":\\\"(?<RequestUTCDateTime>[^\\\"]+)"

Or it can be extracted automatically using an EXTRACT setting in props.conf:

EXTRACT-RequestUTCDateTime = RequestUTCDateTime":"(?<RequestUTCDateTime>[^"]+)
---
If this reply helps you, Karma would be appreciated.

ranjithan
Path Finder

Thank You so much for the help!

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...