How to use regex to extract date?

[kirangurram]

Hello experts , I need some help in extracting date time from the attribute "SrcDtm" in below sample data.

<GI SrcDtm="2019-04-18T18:23:47Z" SrcTmOff="-07:00" SrcAppCd="ABC" SrcCtryCd="IN" SrcFcId="ABCABC" SrcSrvaCd="ABC" SrcFcCd="ABC" CorrId="469429d1-00cd-49a3-906f-fce27fdb4d0c" />

[woodcock]

Like this:

... | rex "SrcDtm=\"(?<SrcDtm>[^\"]+)"

[FrankVl]

Do you already have those key value pairs extracted as fields? If so, you don't need a rex, just a conversion to timestamp:

| eval DateTime = strptime(SrcDtm,"%Y-%m-%dT%H:%M:%SZ")

If you have not extracted key value pairs yet, rex would be one way to do that:

| rex "SrcDtm=\"(?<SrcDtm>[^\"]+)\""
| eval DateTime = strptime(SrcDtm,"%Y-%m-%dT%H:%M:%SZ")