Splunk Search

Using regex syntax to trim timestamp

bjs
Engager

Using regex, what is the syntax, to trim a timestamp formatted like 2022-01-06 01:51:23 UTC so that it only reflects the date and hour, like this  2022-01-06 01

Labels (1)
0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults
| eval time= = 2022-01-06 01:51:23 UTC"
| eval time = replace(time, "\s.*$", "")

bjs
Engager

I was actually able to change the event timestamp by using offset: | rex field=timestamp "(?<timestamp>.{13})"

0 Karma

yuanliu
SplunkTrust
SplunkTrust

What is the use case for string manipulation if this concerns event timestamp (designated by builtin _time field)?  Most of the time, using "| bin span=1h@h _time" allows better handling/flexibility down the pipe, perhaps better performance, too.

If this concerns a text field that is not used as event timestamp, an alternative to regex is split(), like

| eval date_hour = mvindex(split(timestamp, ":"), 0)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed "s/(?<datehour>\d{4}-\d\d-\d\d \d\d)(?<discard>:\d\d:\d\d \w+)/\\1/g"
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...