How do I extract this date time field from my sample data using rex?

[cyberportnoc]

I used this search, but it is not extracting the date time field properly. I will use this date time as a common field to join openstack api to find a public ip.

"conn" | rex field=_raw "(?P...\d+\d+:\d+:\d+)"

2nd try, also no result:

"conn" | rex field=_raw "(?P\[\s*(\d+/\D+/.*?)\])" | stats count by ddate

Sample event:

Jul 28 09:52:47 icns02 slapd[17684]: conn=1228614 fd=22 closed

[inventsekar]

May I know if that rex on my reply worked fine or not.

[inventsekar · Accepted solution]

Tested this and works fine:

conn | rex field=_raw "^(?P\w+\s+\d+\s+\d+:\d+:\d+)" | stats count by ddate