Splunk Search

How do I extract this date time field from my sample data using rex?

cyberportnoc
Explorer

I used this search, but it is not extracting the date time field properly. I will use this date time as a common field to join openstack api to find a public ip.

"conn" | rex field=_raw "(?P...\d+\d+:\d+:\d+)"

2nd try, also no result:

"conn" | rex field=_raw "(?P\[\s*(\d+/\D+/.*?)\])" | stats count by ddate

Sample event:

Jul 28 09:52:47 icns02 slapd[17684]: conn=1228614 fd=22 closed
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Tested this and works fine:

conn | rex field=_raw "^(?P\w+\s+\d+\s+\d+:\d+:\d+)" | stats count by ddate
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

May I know if that rex on my reply worked fine or not.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Tested this and works fine:

conn | rex field=_raw "^(?P\w+\s+\d+\s+\d+:\d+:\d+)" | stats count by ddate
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...