Splunk Search

Remove timestamps using regex

oliverpeloton23
Engager

Hi Splunk Community,

It's been a while since I've last used Splunk and regex, and now I'm struggling with both 🙂

Fields that I need to use ("resourceId") contain two user IDs and timestamps (e.g., "owner-10785-user-3801-key-1637099215"). I'm looking to keep the IDs and remove timestamps (basically everything after "owner-19803-user-8925-").

I came up with this clumsy thing:

index=main | eval resourceId1=replace (resourceId, "user-(?<user_id>\d+)", "") | eval resourceId2=replace (resourceId1, "owner-(?<owner_id>\d+)", "") | table resourceId2

It kind of works, the only problem is that it gives me the opposite result - it removes all the IDs leaving the timestamps, like this:

resourceId2
--key-1637100297
--1637100120.0929909
--key-1637100118

But I need the opposite. Can anyone please help?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=resourceId "owner-(?<owner>\d+)-user-(?<user>\d+)"
| eval resourceId2="owner-".owner."-user-".user

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=resourceId "owner-(?<owner>\d+)-user-(?<user>\d+)"
| eval resourceId2="owner-".owner."-user-".user

oliverpeloton23
Engager

Thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...