How to extract a date from a string?

[rmuraly]

Hi,

I have a string
'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv'

How do I extract '2017-05-12' from 'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv' in my saved search?

[niketn · Accepted solution]

You might have to add mocked up raw data and also your search for us to help you better. However, based on what you have provided please try following regular expression:

| rex field=_raw "_(?<Date>\d{4}-\d{2}-\d{2})_"
| table Date _raw

[niketn]

@rmuraly, I have converted my comment as answer. Please accept to mark the question as answered.

[rmuraly]

I had to extract the date from my source file and this helps me do it.

| stats count | eval source="ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv"| rex field=source"(?\d{4}-\d{2}-\d{2})"
| table Date,source

Thank you

[somesoni2]

If this string is part of an already extracted field, say file_path, then in rex command, use file_path instead of _raw.

[rmuraly]

I had to extract the date from my source file and this helps me do it.

| stats count | eval source="ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv"| rex field=source"(?\d{4}-\d{2}-\d{2})"
| table Date,source

Thank you