Hello,
I have following Sample Event.
Q17CNB_L_0__20210630-235755_5828.html@^@^2021/06/30@^@^23:57:55@^@^ Q17CNB @^@^
I have following REX command to extract ID and DateTime Fields from it
rex "(?<ID>.{6}).*?@\^@\^(?<DateTime>\d\d\d\d\/\d\d\/\d\d@\^@\^\d\d:\d\d:\d\d)
ID looked as expected, but I got DateTime Field as "2021/06/30@^@^23:57:55" . Is there anyways, we can have DateTime Field like "2021/06/30 23:57:55"....without (@^@^) from this Event. Thank you so much, appreciate your support in these efforts.
You could either replace the character with a space
something like
| eval dateField = replace(dateField,"@^", " ")
Maybe you'll have to escape ^ with \^
otherwise you could create a field for the date and one for the time and append them into a new field (most probably less performance)
You could either replace the character with a space
something like
| eval dateField = replace(dateField,"@^", " ")
Maybe you'll have to escape ^ with \^
otherwise you could create a field for the date and one for the time and append them into a new field (most probably less performance)
Thank you so much, appreciate your support.
I think your codes is working as expected. I just have done some tweaking based on your recommendation ......working as expected. Here is the final code:
| rex "(?<ID>.{6}).*?@\^@\^(?<DateTime>\d\d\d\d\/\d\d\/\d\d@\^@\^\d\d:\d\d:\d\d)"
| eval DateTime = replace(DateTime,"@\^@\^", " ")
Thank you again.
I am glad it helped. Btw you can optimize your regular expression
You could for example use \d{4} instead of \d\d\d\d .
You can checkout a cheat sheet like https://cheatography.com/davechild/cheat-sheets/regular-expressions/ for some useful commands 🙂