Splunk Search

How to use multiple numbers in search?

ipteam
Engager

Hello Guys,

I'd like to create a search based on business hours, and like to use a field with value like this: 

"2023/01/20 08:52:58"

The bold number would be interesting, and like to search with multiple values. example 08-18h [08,09,10,11,12,13,14,15,16,17,18]

How could I find a regex to extract theese numbers? 

thanks a lot!

 

Labels (1)
0 Karma
1 Solution

jamie00171
Communicator

Hi @ipteam,

 

Something like this should work for you:

<your search goes here>
| rex field=<insert field name that contains timestamp here> "(?<year>\d{4})\/(?<month>\d{2})\/(?<day>\d{2})\s+(?<hour>\d{2})\:(?<minutes>\d{2})\:(?<seconds>\d{2})"

 

Thanks, 

 

Jamie

View solution in original post

0 Karma

PaulPanther
Contributor

@ipteam You shouldn't need a field extraction. Splunk parses the timestamp into multiple fields like date_hour. 

Sample search:

 

index=_internal
| where date_hour>07 AND date_hour<19

 

 

0 Karma

PickleRick
Ultra Champion

Those time fields are tricky because:

1) They might not get extracted at all

2) They represent the timestamp parts as included in the raw event. So if the original event included some exotic timezone, those fields will be in that timezone.

0 Karma

ipteam
Engager

Yes, would be great, but this filed is not equal to the generated time of the log. Unfortunatly it's a custom one.
Also interested in the regex what splits _time filed to day,hour.. and so on.

0 Karma

jamie00171
Communicator

Hi @ipteam,

 

Something like this should work for you:

<your search goes here>
| rex field=<insert field name that contains timestamp here> "(?<year>\d{4})\/(?<month>\d{2})\/(?<day>\d{2})\s+(?<hour>\d{2})\:(?<minutes>\d{2})\:(?<seconds>\d{2})"

 

Thanks, 

 

Jamie

0 Karma

ipteam
Engager

Hello Jamie,

Works, thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...