Splunk Search
Highlighted

How to grep or awk in splunk?

Explorer

Hi,

I am using this query in splunk search -
index="some_index" | dedup source | sort -source | dedup sourcetype | table sourcetype, source

My result shows like this -
sourcetype | source
--------------------- | ---------------------------------------------------------------
devarchitecturedev1 | /u01/splunk/etc/apps/dev-data/data/dev1/dev1-20150629133045.log
devarchitecturedev2 | /u01/splunk/etc/apps/dev-data/data/dev2/dev2-20150626124438.log

I want to grab only the year, month, day, hour, min and sec right before ".log". e.g. 20150629133045.
And then display it like 2015-06-29 13:30:45 in the 'source' column.

Is there a way to do it in Splunk6?

Thanks for looking at the question. Hoping to get some answers.

Tags (5)
0 Karma
Highlighted

Re: How to grep or awk in splunk?

Communicator

Hi,

You can use this:
......|eval source1=substr(source,-18 ) | eval source=substr(source1,0,14 ) | ......

0 Karma
Highlighted

Re: How to grep or awk in splunk?

Communicator

With your query you can try:

index="some index" | dedup source | sort -source | eval source1=substr(source,-18 ) | eval source=substr(source1,0,14 ) |dedup sourcetype | table sourcetype, source

0 Karma
Highlighted

Re: How to grep or awk in splunk?

Explorer

Thanks..!! this solution works.
However, is there any other way other than substring? Basically want to make the grab dynamic, so if the position changes in another environment, the query would still work.
I have done it in bash using both awk and sed. But seems like splunk syntax are very different.

0 Karma
Highlighted

Re: How to grep or awk in splunk?

Communicator

Yes you can do it using rex also.

index="Some index" | dedup source | sort - source | rex field=source "-(?<source>&bsol;d+)" | dedup sourcetype | table sourcetype, source