Splunk Search

Regular expression to get rid of time info

cpeteman
Contributor

I want to be able to get rid of the time in _raw messages. For example the raw message:

2013-07-31 09:38:44 [<ffffffff81134262>] ? try_to_free_pages+0x92/0x120
Jul 31 11:09:37 edge10 xinetd[3162]: EXIT: mshell status=0 pid=12245 duration=0(sec)

Becomes

2013-07-31 [<ffffffff81134262>] ? try_to_free_pages+0x92/0x120
Jul 31 edge10 xinetd[3162]: EXIT: mshell status=0 pid=12245 duration=0(sec)

It would be nice to get rid of the date but for now all I need is the time gone.

Tags (2)
1 Solution

yannK
Splunk Employee
Splunk Employee

at search time, use the rex command, with the sed mode to replace the date/time before displaying.
Splunk will still use the timestamp extracted to qualify the events.

< mysearch > | rex mode=sed "s/\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}//g" | table _raw

see http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Rex

View solution in original post

yannK
Splunk Employee
Splunk Employee

At index time, use the same approach with a props.conf rule on the indexer. But I am not sure of which timestamp will be used by splunk.

[mysourcetype]
SEDCMD=s/\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}//g

see http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Anonymizedatausingconfigurationfiles

0 Karma

yannK
Splunk Employee
Splunk Employee

at search time, use the rex command, with the sed mode to replace the date/time before displaying.
Splunk will still use the timestamp extracted to qualify the events.

< mysearch > | rex mode=sed "s/\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}//g" | table _raw

see http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Rex

cpeteman
Contributor

| rex mode=sed "s/ \d{1,2}:\d{1,2}:\d{1,2}//g" | table _raw

seems to work for the time but not of course for the date

0 Karma

cpeteman
Contributor

Might work for some cases but I can't tell as there are other cases not covered by this regex, I'll add the issue.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...