Splunk Search
Highlighted

Examples: How do I edit the resulting value in search query?

Champion

I have dates that look like "01/09/2014 00:00:00" that I want to chart. The dates take up too much real estate so I want to edit them so they are just:

01/09, 01/08, 01/07, etc.

0 Karma
Highlighted

Re: Examples: How do I edit the resulting value in search query?

Champion

One way is to use rex. Assuming field named time:

my search | rex field=time "(?P<time>\d+/\d+[^/]+)"

View solution in original post

0 Karma