How to extract time format using rex? "TransactionStartTime=12/19/2017 06:23:35.474"

[karthi2809]

How to extract time format using rex ?

TransactionStartTime=12/19/2017 06:23:35.474;

[mayurr98 · Accepted solution]

if you to extract this as your event time then put below in props.conf

[your_sourcetype]
TIME_PREFIX = TransactionStartTime=
TIME_FORMAT = %m/%d/%y %H:%M:%S.%3N

If you want to extract it in a field called "TransactionStartTime"

index=your_index | rex field=_raw "TransactionStartTime=(?P<TransactionStartTime>\d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2}\.\d{3})"

Let me know if this helps!

[karthi2809]

Thanks you mayurr98