Regex Help

[jkrehrer22]

I have this data:

cfjbht06,08-Apr-2019,18:01:47,2.9,11.6

Splunk is reading this timestamp as:

4/8/19
6:01:47.200 PM

I do NOT want to capture the hundredths of a second, as this is supposed to be a new field. Each field is separated by a ',' (comma).

So, this is what I'm looking for:

4/8/19
6:01:47 PM

Anything helps! Thanks.

[cvssravan]

Hi @jkrehrer22

Try this:

| makeresults | eval timestamp_field = "4/8/19 6:01:47.200 PM" | eval timestamp_field= strptime(timestamp_field, "%m/%d/%y %I:%M:%S.%3Q %p") | fieldformat timestamp_field = strftime(timestamp_field, "%d/%m/%Y %H:%M:%S")