Splunk Search

How to use regex to extract date?

kirangurram
Explorer

Hello experts , I need some help in extracting date time from the attribute "SrcDtm" in below sample data.

<GI SrcDtm="2019-04-18T18:23:47Z" SrcTmOff="-07:00" SrcAppCd="ABC" SrcCtryCd="IN" SrcFcId="ABCABC" SrcSrvaCd="ABC" SrcFcCd="ABC" CorrId="469429d1-00cd-49a3-906f-fce27fdb4d0c" />
Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "SrcDtm=\"(?<SrcDtm>[^\"]+)"
0 Karma

FrankVl
Ultra Champion

Do you already have those key value pairs extracted as fields? If so, you don't need a rex, just a conversion to timestamp:

| eval DateTime = strptime(SrcDtm,"%Y-%m-%dT%H:%M:%SZ")

If you have not extracted key value pairs yet, rex would be one way to do that:

| rex "SrcDtm=\"(?<SrcDtm>[^\"]+)\""
| eval DateTime = strptime(SrcDtm,"%Y-%m-%dT%H:%M:%SZ")
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...