Splunk Search

How to use regex to extract date?

kirangurram
Explorer

Hello experts , I need some help in extracting date time from the attribute "SrcDtm" in below sample data.

<GI SrcDtm="2019-04-18T18:23:47Z" SrcTmOff="-07:00" SrcAppCd="ABC" SrcCtryCd="IN" SrcFcId="ABCABC" SrcSrvaCd="ABC" SrcFcCd="ABC" CorrId="469429d1-00cd-49a3-906f-fce27fdb4d0c" />
Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "SrcDtm=\"(?<SrcDtm>[^\"]+)"
0 Karma

FrankVl
Ultra Champion

Do you already have those key value pairs extracted as fields? If so, you don't need a rex, just a conversion to timestamp:

| eval DateTime = strptime(SrcDtm,"%Y-%m-%dT%H:%M:%SZ")

If you have not extracted key value pairs yet, rex would be one way to do that:

| rex "SrcDtm=\"(?<SrcDtm>[^\"]+)\""
| eval DateTime = strptime(SrcDtm,"%Y-%m-%dT%H:%M:%SZ")
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...