Splunk Search

Extracting date from a date string that has many options

matansocher
Contributor

Hi,

I have a field (string) that contains dates. the fields has a few formats and I need to extract the day, month and year from it.
Examples for the values possible of that field:
4/8/2016
4/8/16
04/8/2016
04/8/16
4/08/2016
04/08/2016
31/08/16

I think regex would be a good way to solve it, but I cant figure out how to use it.

Thanks

0 Karma
1 Solution

HiroshiSatoh
Champion

Try this!

ex.)---extract the day->Day

(your search)|rex field=Date "^(?<wk_day>\d+)\/(?<wk_month>\d+)\/(?<wk_year>\d+)$"
| eval wk_day=if(len(wk_day)=2,wk_day,"0"+wk_day),
  wk_month=if(len(wk_month)=2,wk_month,"0"+wk_month),
  wk_year=if(len(wk_year)=4,wk_year,"20"+wk_year)

View solution in original post

HiroshiSatoh
Champion

Try this!

ex.)---extract the day->Day

(your search)|rex field=Date "^(?<wk_day>\d+)\/(?<wk_month>\d+)\/(?<wk_year>\d+)$"
| eval wk_day=if(len(wk_day)=2,wk_day,"0"+wk_day),
  wk_month=if(len(wk_month)=2,wk_month,"0"+wk_month),
  wk_year=if(len(wk_year)=4,wk_year,"20"+wk_year)

matansocher
Contributor

Thanks! exactly what I needed

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...