Splunk Cloud Platform

How to extract regular expressions?

ranjithan
Path Finder

Hi ,

Need some help to extract regular expressions.

I have a set of unstructured logs . Part of the log is as shown below:

"RequestUTCDateTime":"2022-07-25T11:19:29.0106873Z"} 

How would one extract 2022-07-25T11:19:29.0106873Z   and assign it to field RequestUTCDateTime, .

This should be done whenever "RequestUTCDateTime" is encountered in the raw log.

 

Please help me.

 

Thank You,

Ranjitha N

 

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can extract the field at search-time using the rex command.

| rex "RequestUTCDateTime\\\":\\\"(?<RequestUTCDateTime>[^\\\"]+)"

Or it can be extracted automatically using an EXTRACT setting in props.conf:

EXTRACT-RequestUTCDateTime = RequestUTCDateTime":"(?<RequestUTCDateTime>[^"]+)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can extract the field at search-time using the rex command.

| rex "RequestUTCDateTime\\\":\\\"(?<RequestUTCDateTime>[^\\\"]+)"

Or it can be extracted automatically using an EXTRACT setting in props.conf:

EXTRACT-RequestUTCDateTime = RequestUTCDateTime":"(?<RequestUTCDateTime>[^"]+)
---
If this reply helps you, Karma would be appreciated.

ranjithan
Path Finder

Thank You so much for the help!

 

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...