extract date from string

[sravanthikand]

Hello

I have string from nessus . Wed Jun 6 02:02:10 2018 .

I need to extract the date . strftime and strptime returns NULL.

Any ideas for rex extraction ?

I need to compare and sort the date for the last 45 days .

Thanks

[woodcock]

Along with the answer from @mus, you need to make sure that you have a field myTime first. You create one like this:

| rex "(?<myTime>(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s+\S+\d+\s+\d+:\d+:\d+\s+\d+)"

[MuS]

Hi sravanthikand,

try this strptime() format:

| makeresults 
| eval myTime="Wed Jun 6 02:02:10 2018" 
| eval epoch_time=strptime(myTime, "%c") 
| eval _time=epoch_time

This will create a valid epoch timestamp.

Hope this helps ...

cheers, MuS