Splunk Search

How to transfer Strftime TIME_FORMAT to a regular expression ?

royimad
Builder

Log content (log4j) begin with a date that i will use it as TIME_FORMAT in my props.conf file.

Fri Jan 04 2013 13:05:34,114 EST ERROR wavemark.webapp.interceptors.WmExceptionInterceptor - WaveMarkException occurred
wavemark.common.exceptions.WaveMarkException: Error while calling method [getReportData] in deleg

The TIME_FORMAT should be equal to %a %b %e %Y %k:%M:%S,%3 %Z
I need to convert this to the regular expression to put it on LINE_BREAKER.

So what are the equivalent of my strftime in regular expression? is their a tool to convert this or i just need it to write it from scratch.

Many Thanks,
Roy

0 Karma
1 Solution

gfuente
Motivator

Hello

Try this regex:

\w{3}\s\w{3}\s\d{2}\s\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s\w{3}

Regards

Edited to add miliseconds and time zone, hope it works

View solution in original post

gfuente
Motivator

Hello

Try this regex:

\w{3}\s\w{3}\s\d{2}\s\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s\w{3}

Regards

Edited to add miliseconds and time zone, hope it works

gfuente
Motivator

Done let me know it works

0 Karma

royimad
Builder

How to add the rest of the date the millisecond and the timezone ?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...