Splunk Search

Extract date and time from a message

sravani27
Path Finder

Hi I am trying to extract the date and time from the field "message". It gives me everything after the date and time. I don't want the text after the time.
message
PubAck Packet sent to device 1234A and 12345678910FC at 08-21-2017 22:09:48.401.
Publish message received at 08-21-2017 18:50:04.841 for this service.
Required Output
08-21-2017 22:09:48.401
08-21-2017 18:50:04.841
My regex
rex field=message "at(?.+)"

My result
08-21-2017 22:09:48.401.
08-21-2017 18:50:04.841 for this service.

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust
| makeresults | eval message="Publish message received at 08-21-2017 18:50:04.841 for this service." | rex field=message "at\s+(?P<datetime>\S+\s+\S+)"

View solution in original post

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @sravani27, did either of these solutions work for you?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust
| makeresults | eval message="Publish message received at 08-21-2017 18:50:04.841 for this service." | rex field=message "at\s+(?P<datetime>\S+\s+\S+)"
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this. The fieldname will be time

... | rex \sat\s(?<time>\d+\-\d+\-\d+\s\d+:\d+:\d+\.\d+)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...