Splunk Search

How to grep or awk in splunk?

nilotpaldutta
Explorer

Hi,

I am using this query in splunk search -
index="some_index" | dedup source | sort -source | dedup sourcetype | table sourcetype, source

My result shows like this -
sourcetype | source
--------------------- | ---------------------------------------------------------------
dev_architecture_dev1 | /u01/splunk/etc/apps/dev-data/data/dev1/dev1-20150629133045.log
dev_architecture_dev2 | /u01/splunk/etc/apps/dev-data/data/dev2/dev2-20150626124438.log

I want to grab only the year, month, day, hour, min and sec right before ".log". e.g. 20150629133045.
And then display it like 2015-06-29 13:30:45 in the 'source' column.

Is there a way to do it in Splunk6?

Thanks for looking at the question. Hoping to get some answers.

Tags (5)
0 Karma

ektasiwani
Communicator

Hi,

You can use this:
......|eval source1=substr(source,-18 ) | eval source=substr(source1,0,14 ) | ......

0 Karma

ektasiwani
Communicator

Yes you can do it using rex also.

index="Some index" | dedup source | sort - source | rex field=source "-(?<source>&bsol;d+)" | dedup sourcetype | table sourcetype, source

ektasiwani
Communicator

With your query you can try:

index="some index" | dedup source | sort -source | eval source1=substr(source,-18 ) | eval source=substr(source1,0,14 ) |dedup sourcetype | table sourcetype, source

0 Karma

nilotpaldutta
Explorer

Thanks..!! this solution works.
However, is there any other way other than substring? Basically want to make the grab dynamic, so if the position changes in another environment, the query would still work.
I have done it in bash using both awk and sed. But seems like splunk syntax are very different.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...