Splunk Search

How to extract a date from a string?

rmuraly
Explorer

Hi,

I have a string
'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv'

How do I extract '2017-05-12' from 'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv' in my saved search?

0 Karma
1 Solution

You might have to add mocked up raw data and also your search for us to help you better. However, based on what you have provided please try following regular expression:

| rex field=_raw "_(?<Date>\d{4}-\d{2}-\d{2})_"
| table Date _raw
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

You might have to add mocked up raw data and also your search for us to help you better. However, based on what you have provided please try following regular expression:

| rex field=_raw "_(?<Date>\d{4}-\d{2}-\d{2})_"
| table Date _raw
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

@rmuraly, I have converted my comment as answer. Please accept to mark the question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

rmuraly
Explorer

I had to extract the date from my source file and this helps me do it.

| stats count | eval source="ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv"| rex field=source"(?\d{4}-\d{2}-\d{2})"
| table Date,source

Thank you

0 Karma

somesoni2
Revered Legend

If this string is part of an already extracted field, say file_path, then in rex command, use file_path instead of _raw.

0 Karma

rmuraly
Explorer

I had to extract the date from my source file and this helps me do it.

| stats count | eval source="ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv"| rex field=source"(?\d{4}-\d{2}-\d{2})"
| table Date,source

Thank you

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...