Splunk Search

Modify a date field value using SED

jason_hotchkiss
Communicator

I have a weird date/time value:  20240307105530.358753-360

I would like to make it more user friendly  2024/03/07 10:50:30 and drop the rest.
%Y/%m/%d %H:%M:%S

I know you can use sed for this, however, I am not familiar with sed syntax:

For example:
| rex mode=sed field=_raw "s//g"

Any sed guru's out there?

Labels (2)
0 Karma
1 Solution

marnall
Builder

You can indeed do this with sed and rex:


| rex mode=sed field=<yourfield> "s/(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2}).*/\1\/\2\/\3 \4:\5:\6/"

 

Every captured group in the first part of the sed can be referenced with a backslash+groupnumber. E.g: "\1" for group 1, "\2" for group 2. Everything not captured can be discarded. Forward slashes need to be escaped.

View solution in original post

marnall
Builder

You can indeed do this with sed and rex:


| rex mode=sed field=<yourfield> "s/(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2}).*/\1\/\2\/\3 \4:\5:\6/"

 

Every captured group in the first part of the sed can be referenced with a backslash+groupnumber. E.g: "\1" for group 1, "\2" for group 2. Everything not captured can be discarded. Forward slashes need to be escaped.

jason_hotchkiss
Communicator

Thank you @marnall.  You are the master!

0 Karma

marnall
Builder

Glad to help 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...