Splunk Search

How to transfer Strftime TIME_FORMAT to a regular expression ?

royimad
Builder

Log content (log4j) begin with a date that i will use it as TIME_FORMAT in my props.conf file.

Fri Jan 04 2013 13:05:34,114 EST ERROR wavemark.webapp.interceptors.WmExceptionInterceptor - WaveMarkException occurred
wavemark.common.exceptions.WaveMarkException: Error while calling method [getReportData] in deleg

The TIME_FORMAT should be equal to %a %b %e %Y %k:%M:%S,%3 %Z
I need to convert this to the regular expression to put it on LINE_BREAKER.

So what are the equivalent of my strftime in regular expression? is their a tool to convert this or i just need it to write it from scratch.

Many Thanks,
Roy

0 Karma
1 Solution

gfuente
Motivator

Hello

Try this regex:

\w{3}\s\w{3}\s\d{2}\s\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s\w{3}

Regards

Edited to add miliseconds and time zone, hope it works

View solution in original post

gfuente
Motivator

Hello

Try this regex:

\w{3}\s\w{3}\s\d{2}\s\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s\w{3}

Regards

Edited to add miliseconds and time zone, hope it works

gfuente
Motivator

Done let me know it works

0 Karma

royimad
Builder

How to add the rest of the date the millisecond and the timezone ?

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...