Splunk Search

How to write regex to extract 2014-09-11/06:00:01.708/EDT

gajananh999
Contributor

Dear All,

I stuck at silly thing i am not able to plot regular expression for 2014-09-11/06:00:01.708/EDT
My Regex is : ^\d{4}-\d{2}-\d{2}/\d{2}:\d{2}:\d{2}.\d{3}

But this is not working can anyone tell me where i an going wrong here.

Thanks

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

When importing your data, specify the timestamp string in strptime format. This one worked for me using your example:

%Y-%m-%d/%H:%M:%S.%3N/%Z
---
If this reply helps you, Karma would be appreciated.

srioux
Communicator

Per the note above, if you're using Data Preview, should use strptime formatting. Docs:
http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Modifyeventprocessing#Timestamps

0 Karma

gajananh999
Contributor

Hello MuS,

Its not working for me.
i am trying set Timestamp on Data Preview.

Thanks
Gajanan

0 Karma

MuS
Legend
0 Karma

gajananh999
Contributor

Hello Mus, I have tried without ^ bu no luck. its simple but i dont know where i am going wrong

0 Karma

MuS
Legend

This works on all those online regex testers .... try not to use any ^ or other special signs in the regex.

0 Karma

MuS
Legend

this works up til the timezone, if you need the TZ as well try this:

\d{4}-\d{2}-\d{2}/\d{2}:\d{2}:\d{2}.\d{3}\/\w+

MuS
Legend

or a bit more compact regex like this:

(\d{2,4}[\-\/\:\.])+\w+
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...