Splunk Search

Please help with Date extraction from below string

bhaskar5428
Explorer

i have system column "_time" with below output 

2022-03-16 11:12:18.723

i would like segregate date and time by rex command 

output should be like this with new column name 

Date = 2022-03-16

Time = 11:12:18

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If it is already in the _time field, it is probably already in epoch time format, so try this

| eval Date=strftime(_time,"%F")
| eval Time=strftime(_time,"%T")

View solution in original post

0 Karma

bhaskar5428
Explorer

index=app_events_fx4cash_uk_prod source=*STPManager-servicemanagement.20220316-111218.log*
| rex field=_time "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d"
| table date,time

am using this but getting error 

Error in 'rex' command: Encountered the following error while compiling the regex '^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d': Regex: missing closing parenthesis.
The search job has failed due to an error. You may be able view the job in the 
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bhaskar5428,

sorry I missed a paranthesi at the end of the regex, please try this:

| rex field=_time "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d)"

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If it is already in the _time field, it is probably already in epoch time format, so try this

| eval Date=strftime(_time,"%F")
| eval Time=strftime(_time,"%T")
0 Karma

bhaskar5428
Explorer

Thanks , it worked 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bhaskar5428,

let me understand: are you spoeaking of search time extraction or timestamp configuration?

if search time extraction, you could use a regex like this:

| rex "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d"

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...