Splunk Search

Extract Hostname, Date and time from the log

paullt12345
Explorer

Hi all

I want to extract Hostname, date and time from the log, Kindly help

sample log:
Mar 12 09:13:46 hostname1 <118>1 2019-03-12T09:13:46.743+00:00 ip.address

Hostname Date Time
hostname1 2019-03-12 09:13:46

0 Karma
1 Solution

vnravikumar
Champion

Hi @paullt12345

Try like

| makeresults 
| eval log="Mar 12 09:13:46 hostname1  <118>1 2019-03-12T09:13:46.743+00:00 ip.address" 
| rex field=log ":\d{2}\s+(?P<Hostname>.+)\s+<.*(?P<Date>\d{4}\-\d{2}\-\d{2})T(?P<Time>\d{2}\:\d{2}\:\d{2})"

View solution in original post

vnravikumar
Champion

Hi @paullt12345

Try like

| makeresults 
| eval log="Mar 12 09:13:46 hostname1  <118>1 2019-03-12T09:13:46.743+00:00 ip.address" 
| rex field=log ":\d{2}\s+(?P<Hostname>.+)\s+<.*(?P<Date>\d{4}\-\d{2}\-\d{2})T(?P<Time>\d{2}\:\d{2}\:\d{2})"

paullt12345
Explorer

it works.. thanks..

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...