Splunk Search

How to extract a date from a string?

rmuraly
Explorer

Hi,

I have a string
'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv'

How do I extract '2017-05-12' from 'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv' in my saved search?

0 Karma
1 Solution

niketn
Legend

You might have to add mocked up raw data and also your search for us to help you better. However, based on what you have provided please try following regular expression:

| rex field=_raw "_(?<Date>\d{4}-\d{2}-\d{2})_"
| table Date _raw
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

You might have to add mocked up raw data and also your search for us to help you better. However, based on what you have provided please try following regular expression:

| rex field=_raw "_(?<Date>\d{4}-\d{2}-\d{2})_"
| table Date _raw
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn
Legend

@rmuraly, I have converted my comment as answer. Please accept to mark the question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

rmuraly
Explorer

I had to extract the date from my source file and this helps me do it.

| stats count | eval source="ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv"| rex field=source"(?\d{4}-\d{2}-\d{2})"
| table Date,source

Thank you

0 Karma

somesoni2
Revered Legend

If this string is part of an already extracted field, say file_path, then in rex command, use file_path instead of _raw.

0 Karma

rmuraly
Explorer

I had to extract the date from my source file and this helps me do it.

| stats count | eval source="ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv"| rex field=source"(?\d{4}-\d{2}-\d{2})"
| table Date,source

Thank you

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...