Splunk Search

Some RegEx help with date formatting

efelder0
Communicator

I am extracting a date/time stamp out of some XML; however, I need to strip out the time from the string.

i.e. - 3/7/2012 2:25:52 PM (GMT) --> needs to be: 3/7/2012

What would the REGEX be and would that regex be in the props.conf or can it go in the search string?

Here is the entry in props = EXTRACT-CreateTimeStamp_GMT = (?i)(?P[^<]+)

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

If your XML looks something like this;

<blaha>BLAHA</blaha>
<createtimestampgmt>3/7/2012 2:25:52 PM (GMT)</createtimestampgmt>
<blaha2>BLAHA2</blaha2>

the following props.conf extract would get you the date only

EXTRACT-DateFromTimeStamp = (?i)<createtimestampgmt>(?P<createtimestamp_gmt>[^\s]+)

i.e. read everything from the end of the start tag up to the first whitespace character, and save it as (the somewhat odd name) createtimestamp_gmt

Hope this helps,

Kristian

0 Karma

cvajs
Contributor

efelder0,
what do you mean by "date". date as in "MM/DD/YYYY" or date as "MM/DD/YYYY HH:MM:SS (AM|PM)"

i would opt to use [\d]{2}/[\d]{2}/[\d]{4} to grab MM/DD/YYYY just in case the space comes up missing (not likely, but you never know)

0 Karma

kristian_kolb
Ultra Champion

The REGEX would be the same, i.e.

[^\s]+

if your event text contains square brackets, you need to escape them, otherwise they will be treated as part of the regex, i.e. \[CDATA\[

Please mark the question as answered if this solved your problem. Thanks.

Kristian

0 Karma

efelder0
Communicator

Yes, that worked. However, I have another field that requires reformatting. But, this time I am doing my field extraction from the transforms.conf. For example, I am pulling a field called "IncidentTime" and its value is 12/11/2011 11:16:48 PM. Here is the entry in transforms.conf:
REGEX = (?i)<![CDATA[(?P[a-zA-Z -:\d]+)(?=])

What would the new REGEX be to only include the date string? or would it be better to use the strptime function from within the search?

0 Karma

cvajs
Contributor

not really sure what you are wanting
[\d]{1,2}/[\d]{1,2}/[\d]{4} will grab 3/7/2012 or 12/12/2012 , etc.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...