Splunk Search

How to use regex to extract date?

kirangurram
Explorer

Hello experts , I need some help in extracting date time from the attribute "SrcDtm" in below sample data.

<GI SrcDtm="2019-04-18T18:23:47Z" SrcTmOff="-07:00" SrcAppCd="ABC" SrcCtryCd="IN" SrcFcId="ABCABC" SrcSrvaCd="ABC" SrcFcCd="ABC" CorrId="469429d1-00cd-49a3-906f-fce27fdb4d0c" />
Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "SrcDtm=\"(?<SrcDtm>[^\"]+)"
0 Karma

FrankVl
Ultra Champion

Do you already have those key value pairs extracted as fields? If so, you don't need a rex, just a conversion to timestamp:

| eval DateTime = strptime(SrcDtm,"%Y-%m-%dT%H:%M:%SZ")

If you have not extracted key value pairs yet, rex would be one way to do that:

| rex "SrcDtm=\"(?<SrcDtm>[^\"]+)\""
| eval DateTime = strptime(SrcDtm,"%Y-%m-%dT%H:%M:%SZ")
Get Updates on the Splunk Community!

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...