Solved: Can I create a substring from this string with two... - Page 2

kdimaria · ‎08-30-2017

I was just looking up the eval substr function in splunk and was wondering if it is possible to get a substring from 0 to a character. basically I have a field that contains two times with a message:

Message= hello 8/30/2017 01:32:00 GMT goodbye 8/30/2017 01:33:00 GMT

I basically want to get a substring and grab from the beginning to GMT and set it into a new field Message1 then grab the rest in another substring and put that into message two.
Message1= hello 8/30/2017 01:32:00 GMT
Message2= goodbye 8/30/2017 01:33:00 GMT

cpetterborg · ‎08-30-2017

Try something like:

|  makeresults 
|  eval _raw="Message= hello 8/30/2017 01:32:00 GMT goodbye 8/30/2017 01:33:00 GMT"
|  rex "Message= (?P<Message1>.*?GMT)\s(?P<Message2>.*)"

View solution in original post

Can I create a substring from this string with two timestamps?

Introducing the 2024 SplunkTrust!

Introducing the 2024 Splunk MVPs!

Splunk Custom Visualizations App End of Life