Splunk Search

Regex Help

Engager

I have this data:

cfjbht06,08-Apr-2019,18:01:47,2.9,11.6

Splunk is reading this timestamp as:

4/8/19
6:01:47.200 PM

I do NOT want to capture the hundredths of a second, as this is supposed to be a new field. Each field is separated by a ',' (comma).

So, this is what I'm looking for:

4/8/19
6:01:47 PM

Anything helps! Thanks.

0 Karma

Path Finder

Hi @jkrehrer22

Try this:

| makeresults | eval timestampfield = "4/8/19 6:01:47.200 PM" | eval timestampfield= strptime(timestampfield, "%m/%d/%y %I:%M:%S.%3Q %p") | fieldformat timestampfield = strftime(timestamp_field, "%d/%m/%Y %H:%M:%S")

0 Karma