I am extracting a field out of an XML feed. More specifically, this is the field:
I need some assistance on manipulating my regex statement in props.conf to force the output to look like this:
2012-01-30 12:57:20
Here is what is in my props.conf:
EXTRACT-Last_Updated = (?i)
Any suggestions?
Pulling the time and date out as two separate fields would possibly require the least processing, if that suits:
EXTRACT-Last_Updated = (?i)<x:lastupdated>(?P<last_updated_date>[^T]+)T(?P<last_updated_time>[^<]+)
Maybe then you could concatenate them if necessary.
It doesn't change the regex statement, it changes the rest of your search. After you've extracted both fields, if you want them formatted in the way you're wanting, simply do something like:
<yoursearch> | eval last_updated_dt=last_updated_date+" "+last_updated_time
That will give you a field with the formatting you're looking for while remaining flexible having the time and date separated as FunPolice suggested.
OK, that works.. However, I need to invoke a space between the 2 fields. I believe \s will work here. how does that change the regex statement?
Pulling the time and date out as two separate fields would possibly require the least processing, if that suits:
EXTRACT-Last_Updated = (?i)<x:lastupdated>(?P<last_updated_date>[^T]+)T(?P<last_updated_time>[^<]+)
Maybe then you could concatenate them if necessary.