Splunk Search

Extracting date from a date string that has many options

matansocher
Contributor

Hi,

I have a field (string) that contains dates. the fields has a few formats and I need to extract the day, month and year from it.
Examples for the values possible of that field:
4/8/2016
4/8/16
04/8/2016
04/8/16
4/08/2016
04/08/2016
31/08/16

I think regex would be a good way to solve it, but I cant figure out how to use it.

Thanks

0 Karma
1 Solution

HiroshiSatoh
Champion

Try this!

ex.)---extract the day->Day

(your search)|rex field=Date "^(?<wk_day>\d+)\/(?<wk_month>\d+)\/(?<wk_year>\d+)$"
| eval wk_day=if(len(wk_day)=2,wk_day,"0"+wk_day),
  wk_month=if(len(wk_month)=2,wk_month,"0"+wk_month),
  wk_year=if(len(wk_year)=4,wk_year,"20"+wk_year)

View solution in original post

HiroshiSatoh
Champion

Try this!

ex.)---extract the day->Day

(your search)|rex field=Date "^(?<wk_day>\d+)\/(?<wk_month>\d+)\/(?<wk_year>\d+)$"
| eval wk_day=if(len(wk_day)=2,wk_day,"0"+wk_day),
  wk_month=if(len(wk_month)=2,wk_month,"0"+wk_month),
  wk_year=if(len(wk_year)=4,wk_year,"20"+wk_year)

matansocher
Contributor

Thanks! exactly what I needed

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...