Splunk Search

How to remove the dynamic date and time from the incoming raw data and get the count

aaa2324
Engager

How to compare the incoming data with dynamic date and time with the lookup table, example

i have incoming data in below format where the date and time keeps changing for every new entry

*abc -04/30 08:14:07 - c

*abc -04/30 08:03:20 -c

*abc -04/29 07:06:22 -c

and so on, I have to consolidate all the above data excluding the date and time and need to count how many times it is occurring. In my lookup table I have the same data in below format.

*abc -mm/dd hh:mm:ss -c

*abc -mm/dd hh:mm:ss-c

is there a way to get the desired results. ? Kindly advise 

Labels (2)
0 Karma

aaa2324
Engager

Thanks how to change the script if there is comma in the middle

*abc -04/30, 08:14:07 - c

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

You add comma in the regex.

| rex mode=sed "s/\d{2}\/\d{2},?\s\d{2}:\d{2}:\d{2}//g"
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

You can use rex to remove the date time in the raw data.

| rex mode=sed "s/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2}//g"
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...