Splunk Search

Date field Extraction ??

rakesh_498115
Motivator

Hi,

I have the following format of Dates in my logs like 2007/01/25 and 2006/12 . i want to extract these dates to a single field called Date. I have written the regular expression like this..

"(?i)/.*?/(?P\d+/\d+/\d+)/\w+"

but this is extrating only the format 2007/01/25 .. but i couldn't extract 2006/12 ..how can i write a single regular expression to extract both the dates ???

please help

Tags (1)
0 Karma
1 Solution

Rob
Splunk Employee
Splunk Employee

Without knowing what the source looks like, this is a bit more difficult to answer. It also looks like you are using the interactive field extractor feature in Splunk. However, the simplest regex for use with the rex command based on your example would be:

|rex field=yourField "(?<1date>[\d/]+)\s\w+"

View solution in original post

Rob
Splunk Employee
Splunk Employee

Without knowing what the source looks like, this is a bit more difficult to answer. It also looks like you are using the interactive field extractor feature in Splunk. However, the simplest regex for use with the rex command based on your example would be:

|rex field=yourField "(?<1date>[\d/]+)\s\w+"

rakesh_498115
Motivator

Thanx Rob :slightly_smiling_face:

0 Karma

Rob
Splunk Employee
Splunk Employee

@rakesh498115
I edited the regex above to match what you are looking for. That should do the job.

0 Karma

rakesh_498115
Motivator

I have log events like

event1

2007/02/12 <>sdsdsdsddad
asdasdasdasdsadasdasd
asdsdad

event2

2006/12 <> dasdasdasdasd
asdas
dsadsadsadsadasdasdsadsa
sadsa

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...