Field extraction in XML (need some regex assistance)

[efelder0]

I am extracting a field out of an XML feed. More specifically, this is the field:
2012-01-30T12:57:20/x:LastUpdated

I need some assistance on manipulating my regex statement in props.conf to force the output to look like this:

2012-01-30 12:57:20

Here is what is in my props.conf:
EXTRACT-Last_Updated = (?i)(?P[^<]+)

Any suggestions?

[clintsharp]

It doesn't change the regex statement, it changes the rest of your search. After you've extracted both fields, if you want them formatted in the way you're wanting, simply do something like:

<yoursearch> | eval last_updated_dt=last_updated_date+" "+last_updated_time

That will give you a field with the formatting you're looking for while remaining flexible having the time and date separated as FunPolice suggested.

[efelder0]

OK, that works.. However, I need to invoke a space between the 2 fields. I believe \s will work here. how does that change the regex statement?

[FunPolice · Accepted solution]

Pulling the time and date out as two separate fields would possibly require the least processing, if that suits:

EXTRACT-Last_Updated = (?i)<x:lastupdated>(?P<last_updated_date>[^T]+)T(?P<last_updated_time>[^<]+)

Maybe then you could concatenate them if necessary.