How to write regex to extract 2014-09-11/06:00:01.708/EDT

[gajananh999]

Dear All,

I stuck at silly thing i am not able to plot regular expression for 2014-09-11/06:00:01.708/EDT
My Regex is : ^\d{4}-\d{2}-\d{2}/\d{2}:\d{2}:\d{2}.\d{3}

But this is not working can anyone tell me where i an going wrong here.

Thanks

[richgalloway]

When importing your data, specify the timestamp string in strptime format. This one worked for me using your example:

%Y-%m-%d/%H:%M:%S.%3N/%Z

[srioux]

Per the note above, if you're using Data Preview, should use strptime formatting. Docs:
http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Modifyeventprocessing#Timestamps

[gajananh999]

Hello MuS,

Its not working for me.
i am trying set Timestamp on Data Preview.

Thanks
Gajanan

[MuS]

did you check the docs http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Configuretimestamprecognition ?

[gajananh999]

Hello Mus, I have tried without ^ bu no luck. its simple but i dont know where i am going wrong

[MuS]

This works on all those online regex testers .... try not to use any ^ or other special signs in the regex.

[MuS]

this works up til the timezone, if you need the TZ as well try this:

\d{4}-\d{2}-\d{2}/\d{2}:\d{2}:\d{2}.\d{3}\/\w+

[MuS]

or a bit more compact regex like this:

(\d{2,4}[\-\/\:\.])+\w+