Splunk Search

regex to split time/date from field in lookup for timechart

Communicator

I have a lookup and would like to extract the date for a time chart

alt text

TIA

Tags (1)
0 Karma
1 Solution

Champion

Hi @nathanluke86

Try the below rex

| makeresults 
| eval whenCreated="04:25.45 PM, Thu 10/01/2015" 
| rex field=whenCreated "(?P<date>\d{2}\/\d{2}\/\d{4}$)"

View solution in original post

Champion

Hi @nathanluke86

Try the below rex

| makeresults 
| eval whenCreated="04:25.45 PM, Thu 10/01/2015" 
| rex field=whenCreated "(?P<date>\d{2}\/\d{2}\/\d{4}$)"

View solution in original post

Communicator

Took line 3 from above Thanks

0 Karma

Contributor

Hello. Try this:

| makeresults 
| eval timeStamp="04:24.45 PM, Thu 10/01/2015"
| rex field=timeStamp "(?<time>\d+:\d+\.\d+\s\w+)\,\s\w+\s(?<date>\d+\/\d+\/\d+)"
0 Karma

Influencer

Try:
| rex field=whenCreated "(?[\d:.\sAPM]+),\s\w{3}\s(?[\d/]+)"

Sample query:

| makeresults | eval whenCreated="04:25.45 PM, Thu 10/01/2015" | rex field=whenCreated "(?<time>[\d:.\sAPM]+),\s\w{3}\s(?<date>[\d/]+)"

Communicator

@oscar84x @manjunathmeti @vnravikumar

I have multiple dates in the whenCreated column in the lookup (240 results all different times).

What I am trying to achieve is to just use the results of the lookup using two fields

timechart user by whenCreated if that make sense

TIA

0 Karma