Please help with Date extraction from below string

[bhaskar5428]

i have system column "_time" with below output 

2022-03-16 11:12:18.723

i would like segregate date and time by rex command 

output should be like this with new column name 

Date = 2022-03-16

Time = 11:12:18

[bhaskar5428]

index=app_events_fx4cash_uk_prod source=*STPManager-servicemanagement.20220316-111218.log*
| rex field=_time "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d"
| table date,time

am using this but getting error 

Error in 'rex' command: Encountered the following error while compiling the regex '^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d': Regex: missing closing parenthesis.

The search job has failed due to an error. You may be able view the job in the 

[gcusello]

Hi @bhaskar5428,

sorry I missed a paranthesi at the end of the regex, please try this:

| rex field=_time "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d)"

Ciao.

Giuseppe

[ITWhisperer · Accepted solution]

If it is already in the _time field, it is probably already in epoch time format, so try this

| eval Date=strftime(_time,"%F")
| eval Time=strftime(_time,"%T")

[bhaskar5428]

Thanks , it worked 

[gcusello]

Hi @bhaskar5428,

let me understand: are you spoeaking of search time extraction or timestamp configuration?

if search time extraction, you could use a regex like this:

| rex "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d"

Ciao.

Giuseppe