Splunk Search

How to extract time format using rex? "TransactionStartTime=12/19/2017 06:23:35.474"

karthi2809
Builder

How to extract time format using rex ?

TransactionStartTime=12/19/2017 06:23:35.474;

0 Karma
1 Solution

mayurr98
Super Champion

if you to extract this as your event time then put below in props.conf

[your_sourcetype]
TIME_PREFIX = TransactionStartTime=
TIME_FORMAT = %m/%d/%y %H:%M:%S.%3N

If you want to extract it in a field called "TransactionStartTime"

index=your_index | rex field=_raw "TransactionStartTime=(?P<TransactionStartTime>\d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2}\.\d{3})"

Let me know if this helps!

View solution in original post

mayurr98
Super Champion

if you to extract this as your event time then put below in props.conf

[your_sourcetype]
TIME_PREFIX = TransactionStartTime=
TIME_FORMAT = %m/%d/%y %H:%M:%S.%3N

If you want to extract it in a field called "TransactionStartTime"

index=your_index | rex field=_raw "TransactionStartTime=(?P<TransactionStartTime>\d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2}\.\d{3})"

Let me know if this helps!

karthi2809
Builder

Thanks you mayurr98

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...