Splunk Search

Regular expression to get rid of time info

cpeteman
Contributor

I want to be able to get rid of the time in _raw messages. For example the raw message:

2013-07-31 09:38:44 [<ffffffff81134262>] ? try_to_free_pages+0x92/0x120
Jul 31 11:09:37 edge10 xinetd[3162]: EXIT: mshell status=0 pid=12245 duration=0(sec)

Becomes

2013-07-31 [<ffffffff81134262>] ? try_to_free_pages+0x92/0x120
Jul 31 edge10 xinetd[3162]: EXIT: mshell status=0 pid=12245 duration=0(sec)

It would be nice to get rid of the date but for now all I need is the time gone.

Tags (2)
1 Solution

yannK
Splunk Employee
Splunk Employee

at search time, use the rex command, with the sed mode to replace the date/time before displaying.
Splunk will still use the timestamp extracted to qualify the events.

< mysearch > | rex mode=sed "s/\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}//g" | table _raw

see http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Rex

View solution in original post

yannK
Splunk Employee
Splunk Employee

At index time, use the same approach with a props.conf rule on the indexer. But I am not sure of which timestamp will be used by splunk.

[mysourcetype]
SEDCMD=s/\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}//g

see http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Anonymizedatausingconfigurationfiles

0 Karma

yannK
Splunk Employee
Splunk Employee

at search time, use the rex command, with the sed mode to replace the date/time before displaying.
Splunk will still use the timestamp extracted to qualify the events.

< mysearch > | rex mode=sed "s/\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}//g" | table _raw

see http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Rex

cpeteman
Contributor

| rex mode=sed "s/ \d{1,2}:\d{1,2}:\d{1,2}//g" | table _raw

seems to work for the time but not of course for the date

0 Karma

cpeteman
Contributor

Might work for some cases but I can't tell as there are other cases not covered by this regex, I'll add the issue.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...