Splunk Search

How to extract time and format using regex?

ninisimonishvil
Path Finder

Hello fellows,

I have an issue that I'm not really sure how to solve.

Well in event I have time in following format "datetime":"20180829 073501672".

I have created a regex that will extract this line but now I need to format it following way 2018 08 29 07:35:01:672.

Any suggestions?

0 Karma
1 Solution

inventsekar
Super Champion

Convert it into a date type variable using strptime and then format it using stftime -

yoursearch....| eval datetimeNEW=strftime(strptime(datetime, "%Y%m%d %H%M%S%3Q"), "%Y %m %d %H:%M:%S:%3Q")
PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

View solution in original post

inventsekar
Super Champion

Convert it into a date type variable using strptime and then format it using stftime -

yoursearch....| eval datetimeNEW=strftime(strptime(datetime, "%Y%m%d %H%M%S%3Q"), "%Y %m %d %H:%M:%S:%3Q")
PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

ninisimonishvil
Path Finder

Thanks it worked. however now with this, I will not be able to make _time (index time) = datetimeNEW correct?

0 Karma

inventsekar
Super Champion

you can use _time inside the strptime command...
eval datetimeNEW=strftime(strptime(_time, "%Y%m%d %H%M%S%3Q"), "%Y %m %d %H:%M:%S:%3Q")

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

ninisimonishvil
Path Finder

sorry for confusion what I meant is that I don't want _time to be equal to index time (that's what splunk does right now) I want it to use my datetimeNEW as a _time.

0 Karma

inventsekar
Super Champion

well, once the data is indexed, we can not / should not update the timestamp "_time ".
maybe, if you update us the more clear info about your issue, there can be some workaround.

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

ninisimonishvil
Path Finder

one more question, how can I make a small change in my datetimnew? something like eval eval newtime=datetimenew+4 hours?

0 Karma

inventsekar
Super Champion

from Ayn's answer at - https://answers.splunk.com/answers/103552/adding-seconds-to-time.html

_time is actually in epoch format, Splunk just converts the format automatically before showing it to you so that it's human readable. So, to add 4 seconds, just do eval _time=_time+4.

Note that this is purely a search-time operation - if you want to do this at index-time the problem is much more complex because functions for performing arithmetic etc are not available.

so, do the strptime/strftime conversions after adding the 4hrs to _time..
you can easily add 4 hours to _time like -
eval _time=_time+14400

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

ninisimonishvil
Path Finder

thank, I did that, but however not getting results.
with eval newtime=datetimenew I see new field newtime in list but as soon as I add
eval newtime=datetimenew+14400 no results.

0 Karma

inventsekar
Super Champion

check these...
| eval newtime=_time+14400
| eval datetimeNEW=strftime(strptime(newtime, "%Y%m%d %H%M%S%3Q"), "%Y %m %d %H:%M:%S:%3Q")

or

| eval datetimenew_epoch = strptime('datetimenew', "%Y %m %d %H:%M:%S:%3Q")
| eval datetimeAdded = datetimenew_epoch + 14400
| eval datetimeResult = strftime(datetimeAdded,  "%Y %m %d %H:%M:%S:%3Q")
PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

ninisimonishvil
Path Finder

yes thanks! I just messed up with parentheses.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...