Splunk Search

How do I get a substring from a field after the "_" character?

vb1612
New Member

I have a string as ABCD_20190219_XYZ

I need to get 20190219 like 8 characters after first "_" and than convert that substring to a date.

Thanks

Tags (3)
0 Karma
1 Solution

Vijeta
Influencer

You can use rex to get the date substring and then use strptime and strftime to date format. Suppose your string is x="ABCD_20190219_XYZ", then use the below command.

rex field=x "_(?<date>\S{8})"| eval time=strptime(date,"%Y%m%d")|eval Date=strftime(time,"%m/%d/%Y")

View solution in original post

0 Karma

Vijeta
Influencer

You can use rex to get the date substring and then use strptime and strftime to date format. Suppose your string is x="ABCD_20190219_XYZ", then use the below command.

rex field=x "_(?<date>\S{8})"| eval time=strptime(date,"%Y%m%d")|eval Date=strftime(time,"%m/%d/%Y")
0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...