REX-Field Extraction Issues with Special Characters

[SplunkDash]

Hello,

I have following Sample Event.

Q17CNB_L_0__20210630-235755_5828.html@^@^2021/06/30@^@^23:57:55@^@^ Q17CNB @^@^

I have following REX command to extract ID and DateTime Fields from it

rex "(?<ID>.{6}).*?@\^@\^(?<DateTime>\d\d\d\d\/\d\d\/\d\d@\^@\^\d\d:\d\d:\d\d) 

 ID looked as expected, but I got DateTime Field as  "2021/06/30@^@^23:57:55" . Is there anyways, we can have DateTime Field like "2021/06/30 23:57:55"....without (@^@^) from this Event. Thank you so much, appreciate your support in these efforts.

[SaltyHash123 · Accepted solution]

You could either replace the character with a space

something like

| eval dateField = replace(dateField,"@^", " ")

Maybe you'll have to escape ^ with \^

otherwise you could create a field for the date and one for the time and append them into a new field (most probably less performance)

[SplunkDash]

Thank you so much, appreciate your support.

I think your codes is working as expected. I just have done some tweaking based on your recommendation ......working as expected. Here is the final code:

| rex "(?<ID>.{6}).*?@\^@\^(?<DateTime>\d\d\d\d\/\d\d\/\d\d@\^@\^\d\d:\d\d:\d\d)"

| eval DateTime = replace(DateTime,"@\^@\^", " ")

Thank you again.

[SaltyHash123]

I am glad it helped.  Btw you can optimize your regular expression

You could for example use \d{4} instead of \d\d\d\d . 

You can checkout a cheat sheet  like https://cheatography.com/davechild/cheat-sheets/regular-expressions/ for some useful commands 🙂