Splunk Search

how to use rex commmand?

smallbearice
New Member

this is my data.

Field:time

Value:2017-05-02 06:31:04

I want to capture the value to use ''rex'' command .for example: 2017-05-02 06:31:04
So,I choose this command.
rex field=time "(?2017/05/02 06:31:\d{2})
but it can't work. Can you help me?

Tags (1)
0 Karma
1 Solution

fwijnholds_splu
Splunk Employee
Splunk Employee

A copy of the _RAW log would help. But I think I believe you might be missing the named group, for the new field you are extracting. Give this a go:

rex field=time "2017/05/02 06:31:(?<seconds>\d{2}" 

View solution in original post

0 Karma

fwijnholds_splu
Splunk Employee
Splunk Employee

A copy of the _RAW log would help. But I think I believe you might be missing the named group, for the new field you are extracting. Give this a go:

rex field=time "2017/05/02 06:31:(?<seconds>\d{2}" 
0 Karma

smallbearice
New Member

I forget to add ,so my "rex" command is false.
Thanks,It can work.

0 Karma

sravankaripe
Communicator

try this
rex "(?<Time>\d+-\d+-\d+\s+\d+:\d+:\d+)"

0 Karma

Richfez
SplunkTrust
SplunkTrust

Please be sure to use the code button on the toolbar (101010) to add code or events - otherwise the editor eats parts of it.

0 Karma

woodcock
Esteemed Legend

Do you mean this?

Field    Value
time     2017-05-02 06:31:04

In other words a row with a field named Field whose value is time and another field named Value whose value is 2017-05-02 06:31:04?
And if so, are you trying to make it so that this row has a field named time whose value is 2017-05-02 06:31:04?
We need much more clarity on what your actual source data looks like and what your desired output is.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...