Splunk Search

Examples: How do I edit the resulting value in search query?

the_wolverine
Champion

I have dates that look like "01/09/2014 00:00:00" that I want to chart. The dates take up too much real estate so I want to edit them so they are just:

01/09, 01/08, 01/07, etc.

0 Karma
1 Solution

the_wolverine
Champion

One way is to use rex. Assuming field named time:

my search | rex field=time "(?P<time>\d+/\d+[^/]+)"

View solution in original post

0 Karma

the_wolverine
Champion

One way is to use rex. Assuming field named time:

my search | rex field=time "(?P<time>\d+/\d+[^/]+)"
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...