Splunk Search

Regex Help


I have this data:


Splunk is reading this timestamp as:

6:01:47.200 PM

I do NOT want to capture the hundredths of a second, as this is supposed to be a new field. Each field is separated by a ',' (comma).

So, this is what I'm looking for:

6:01:47 PM

Anything helps! Thanks.

0 Karma

Path Finder

Hi @jkrehrer22

Try this:

| makeresults | eval timestamp_field = "4/8/19 6:01:47.200 PM" | eval timestamp_field= strptime(timestamp_field, "%m/%d/%y %I:%M:%S.%3Q %p") | fieldformat timestamp_field = strftime(timestamp_field, "%d/%m/%Y %H:%M:%S")

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!