i have system column "_time" with below output
2022-03-16 11:12:18.723
i would like segregate date and time by rex command
output should be like this with new column name
Date = 2022-03-16
Time = 11:12:18
If it is already in the _time field, it is probably already in epoch time format, so try this
| eval Date=strftime(_time,"%F")
| eval Time=strftime(_time,"%T")
index=app_events_fx4cash_uk_prod source=*STPManager-servicemanagement.20220316-111218.log*
| rex field=_time "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d"
| table date,time
am using this but getting error
Hi @bhaskar5428,
sorry I missed a paranthesi at the end of the regex, please try this:
| rex field=_time "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d)"
Ciao.
Giuseppe
If it is already in the _time field, it is probably already in epoch time format, so try this
| eval Date=strftime(_time,"%F")
| eval Time=strftime(_time,"%T")
Thanks , it worked
Hi @bhaskar5428,
let me understand: are you spoeaking of search time extraction or timestamp configuration?
if search time extraction, you could use a regex like this:
| rex "^(?<date>\d\d\d\d-\d\d-\d\d)\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d"
Ciao.
Giuseppe