Splunk Search

How to transfer Strftime TIME_FORMAT to a regular expression ?

royimad
Builder

Log content (log4j) begin with a date that i will use it as TIME_FORMAT in my props.conf file.

Fri Jan 04 2013 13:05:34,114 EST ERROR wavemark.webapp.interceptors.WmExceptionInterceptor - WaveMarkException occurred
wavemark.common.exceptions.WaveMarkException: Error while calling method [getReportData] in deleg

The TIME_FORMAT should be equal to %a %b %e %Y %k:%M:%S,%3 %Z
I need to convert this to the regular expression to put it on LINE_BREAKER.

So what are the equivalent of my strftime in regular expression? is their a tool to convert this or i just need it to write it from scratch.

Many Thanks,
Roy

0 Karma
1 Solution

gfuente
Motivator

Hello

Try this regex:

\w{3}\s\w{3}\s\d{2}\s\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s\w{3}

Regards

Edited to add miliseconds and time zone, hope it works

View solution in original post

gfuente
Motivator

Hello

Try this regex:

\w{3}\s\w{3}\s\d{2}\s\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s\w{3}

Regards

Edited to add miliseconds and time zone, hope it works

gfuente
Motivator

Done let me know it works

0 Karma

royimad
Builder

How to add the rest of the date the millisecond and the timezone ?

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...