Splunk Search

Regex Help

jkrehrer22
Engager

I have this data:

cfjbht06,08-Apr-2019,18:01:47,2.9,11.6

Splunk is reading this timestamp as:

4/8/19
6:01:47.200 PM

I do NOT want to capture the hundredths of a second, as this is supposed to be a new field. Each field is separated by a ',' (comma).

So, this is what I'm looking for:

4/8/19
6:01:47 PM

Anything helps! Thanks.

0 Karma

cvssravan
Path Finder

Hi @jkrehrer22

Try this:

| makeresults | eval timestamp_field = "4/8/19 6:01:47.200 PM" | eval timestamp_field= strptime(timestamp_field, "%m/%d/%y %I:%M:%S.%3Q %p") | fieldformat timestamp_field = strftime(timestamp_field, "%d/%m/%Y %H:%M:%S")

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...