Splunk Search

How do I extract this date time field from my sample data using rex?

cyberportnoc
Explorer

I used this search, but it is not extracting the date time field properly. I will use this date time as a common field to join openstack api to find a public ip.

"conn" | rex field=_raw "(?P...\d+\d+:\d+:\d+)"

2nd try, also no result:

"conn" | rex field=_raw "(?P\[\s*(\d+/\D+/.*?)\])" | stats count by ddate

Sample event:

Jul 28 09:52:47 icns02 slapd[17684]: conn=1228614 fd=22 closed
0 Karma
1 Solution

inventsekar
Ultra Champion

Tested this and works fine:

conn | rex field=_raw "^(?P\w+\s+\d+\s+\d+:\d+:\d+)" | stats count by ddate

View solution in original post

inventsekar
Ultra Champion

May I know if that rex on my reply worked fine or not.

0 Karma

inventsekar
Ultra Champion

Tested this and works fine:

conn | rex field=_raw "^(?P\w+\s+\d+\s+\d+:\d+:\d+)" | stats count by ddate
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...