Splunk Search

How to grep or awk in splunk?

nilotpaldutta
Explorer

Hi,

I am using this query in splunk search -
index="some_index" | dedup source | sort -source | dedup sourcetype | table sourcetype, source

My result shows like this -
sourcetype | source
--------------------- | ---------------------------------------------------------------
dev_architecture_dev1 | /u01/splunk/etc/apps/dev-data/data/dev1/dev1-20150629133045.log
dev_architecture_dev2 | /u01/splunk/etc/apps/dev-data/data/dev2/dev2-20150626124438.log

I want to grab only the year, month, day, hour, min and sec right before ".log". e.g. 20150629133045.
And then display it like 2015-06-29 13:30:45 in the 'source' column.

Is there a way to do it in Splunk6?

Thanks for looking at the question. Hoping to get some answers.

Tags (5)
0 Karma

ektasiwani
Communicator

Hi,

You can use this:
......|eval source1=substr(source,-18 ) | eval source=substr(source1,0,14 ) | ......

0 Karma

ektasiwani
Communicator

Yes you can do it using rex also.

index="Some index" | dedup source | sort - source | rex field=source "-(?<source>&bsol;d+)" | dedup sourcetype | table sourcetype, source

ektasiwani
Communicator

With your query you can try:

index="some index" | dedup source | sort -source | eval source1=substr(source,-18 ) | eval source=substr(source1,0,14 ) |dedup sourcetype | table sourcetype, source

0 Karma

nilotpaldutta
Explorer

Thanks..!! this solution works.
However, is there any other way other than substring? Basically want to make the grab dynamic, so if the position changes in another environment, the query would still work.
I have done it in bash using both awk and sed. But seems like splunk syntax are very different.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...