Splunk Search

Using regex on Extracted field

373782073
Explorer

Hi,
I have incoming syslog events for which I've used the Field Extraction wizard in SPLUNK to separate a the filename of the events which results in the field values look like this:

abc-servicen.City-backup-1986-01-08-16:00:43-level1.tar

I would like to eventually extract and tabulate the filename (I've called it bkp_filename when I extracted this field earlier) as well as the date YYYY-MM-DD for each filename in a separate field (call it bkp_file_date).

Can anyone suggest how to use regex or an in-built function to achieve the date extraction into a separate field or column?

Thanks

0 Karma
1 Solution

MuS
Legend

Hi 373782073,

Give this a try:

| makeresults 
| eval example="abc-servicen.City-backup-1986-01-08-16:00:43-level1.tar" 
| rex field=example "(?<bkp_filename>[a-zA-Z-\.]+)-(?<bkp_file_date>\d{4}-\d{2}-\d{2})"

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi 373782073,

Give this a try:

| makeresults 
| eval example="abc-servicen.City-backup-1986-01-08-16:00:43-level1.tar" 
| rex field=example "(?<bkp_filename>[a-zA-Z-\.]+)-(?<bkp_file_date>\d{4}-\d{2}-\d{2})"

Hope this helps ...

cheers, MuS

0 Karma

373782073
Explorer

Great. I was able to add the rex statement to my existing search and strip the info I wanted into separate fields.
Thanks a lot!

0 Karma

niketn
Legend

@373782073 is the above example the backup file name bkp_filename from which you need to extract date?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

373782073
Explorer

Yes this is the field extracted which has the date embedded

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...