Splunk Search

How to separate a timestamp into individual fields at index-time (year, month, day, hour, minute)?

lennys26
Communicator

Hello.

I am having issues with breaking a timestamp field into its components.

Currently the field is in the format of: 2015-04-14 19:25:21
I need the data to be in separate fields: *Year, month, day, hour, minute *

I have tried variations on eval using strptime, strftime, and have looked at using a REX on it, however, I am not making progress.

This will be a heavily used set of fields, so I would prefer to get this into my props file rather than being a searchtime action. My current props.conf is:

[csv-cdr]
CHECK_FOR_HEADER = false
KV_MODE = auto
NO_BINARY_CHECK = 1
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = False
pulldown_type = 1
FIELD_DELIMITER = ,
FIELD_NAMES = [ clid,src,dst,dcontext,channel,dstchannel,lastapp,lastdata,start,answer,end,duration,billsec,disposition,amaflags,accountcode,unique
id,userfield,peeraccount,linkedid,sequence

Thanks.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This regex should extract the parts you want.

"(?P<year>\d{4})-(?P<mon>\d{2})-(?P<date>\d{2}) (?P<hour>\d{2}):(?P<minute>\d{2})"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This regex should extract the parts you want.

"(?P<year>\d{4})-(?P<mon>\d{2})-(?P<date>\d{2}) (?P<hour>\d{2}):(?P<minute>\d{2})"
---
If this reply helps you, Karma would be appreciated.

lennys26
Communicator

Hi Rich. Great - that worked perfectly.

How would I go about incorporating that in an index time thing.... I guess that props or transforms but not sure which or how.

Thanks again.

0 Karma

somesoni2
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...