Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to extract a date from a string?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a string
'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv'
How do I extract '2017-05-12' from 'ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv' in my saved search?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You might have to add mocked up raw data and also your search for us to help you better. However, based on what you have provided please try following regular expression:
| rex field=_raw "_(?<Date>\d{4}-\d{2}-\d{2})_"
| table Date _raw
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You might have to add mocked up raw data and also your search for us to help you better. However, based on what you have provided please try following regular expression:
| rex field=_raw "_(?<Date>\d{4}-\d{2}-\d{2})_"
| table Date _raw
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rmuraly, I have converted my comment as answer. Please accept to mark the question as answered.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had to extract the date from my source file and this helps me do it.
| stats count | eval source="ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv"| rex field=source"(?\d{4}-\d{2}-\d{2})"
| table Date,source
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If this string is part of an already extracted field, say file_path, then in rex command, use file_path instead of _raw.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had to extract the date from my source file and this helps me do it.
| stats count | eval source="ABC_GFD_NOCS_RPT_HIST_2017-05-12_5min.csv"| rex field=source"(?\d{4}-\d{2}-\d{2})"
| table Date,source
Thank you
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security
Announcing Modern Navigation: A New Era of Splunk User Experience
Detection Engineering Office Hours: Real-World Troubleshooting & Q&A
