Splunk Search

How to transform this date format from 20151412 to 2015-14-12 using rex?

bruno_eduardo
Path Finder

Hi,

I am getting the input source file date from the name of the file itself (sourcefilename20151412.csv), like this:

index="radius"   |eval subname=substr(source,14,8) |top subname |table subname

result: 20151412

I want to transform this time format from 20151412 to 2015-14-12

Is it possible with rex? I would like know more about rex.

Thanks

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Rex is only one way to do this. You could use three substr commands to get the parts and then put them together using concatenation. Since you asked for rex, here is one method.

... | rex field=subname mode=sed "s/(\d{4})(\d{2})(\d{2})/\1-\2-\3/" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Rex is only one way to do this. You could use three substr commands to get the parts and then put them together using concatenation. Since you asked for rex, here is one method.

... | rex field=subname mode=sed "s/(\d{4})(\d{2})(\d{2})/\1-\2-\3/" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Perfectly valid approach. A quick test shows that eval/strptime is about 30% faster (on my laptop) when comparing to rex/sed with a query against a little over 100k sample events, so if efficiency is important, I would consider that.

If you want to test in your environment, try
... | eval myDate = strftime( subname, "%Y-%m-%d")

It won't help you in your quest to learn more about the rex command, though. 🙂

bruno_eduardo
Path Finder

Thank you

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Why not just follow it up with a | eval newDate = strptime(...) according to the docs here?

Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...