Splunk Search

Using regex syntax to trim timestamp

bjs
Engager

Using regex, what is the syntax, to trim a timestamp formatted like 2022-01-06 01:51:23 UTC so that it only reflects the date and hour, like this  2022-01-06 01

Labels (1)
0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults
| eval time= = 2022-01-06 01:51:23 UTC"
| eval time = replace(time, "\s.*$", "")

bjs
Engager

I was actually able to change the event timestamp by using offset: | rex field=timestamp "(?<timestamp>.{13})"

0 Karma

yuanliu
SplunkTrust
SplunkTrust

What is the use case for string manipulation if this concerns event timestamp (designated by builtin _time field)?  Most of the time, using "| bin span=1h@h _time" allows better handling/flexibility down the pipe, perhaps better performance, too.

If this concerns a text field that is not used as event timestamp, an alternative to regex is split(), like

| eval date_hour = mvindex(split(timestamp, ":"), 0)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed "s/(?<datehour>\d{4}-\d\d-\d\d \d\d)(?<discard>:\d\d:\d\d \w+)/\\1/g"
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...