DateTime format search in the splunk search query

Question

I have "YYYY-MM-DD HH:MM:SS.QQ ERROR" in my splunk logs. Now I want to search for similar date pattern along with Status like "2021-Apr-08 23:08:23.498 ERROR" in my splunk logs and create alert if the ERROR tag comes next to the date. These date are changeable and are generated at run time.

Can any one suggest me how to check for Date time format along with Status in splunk query.

Answer 1

In the title you mentioned Amazon Web Services. If your events are actual AWS log data, you could install the Splunk Add-on for Amazon Web Services: https://splunkbase.splunk.com/app/1876/

The add-on comes with a lot of field extractions. After installing the add-on, all you need to do is have a look at your events to find out the correct field name for the status text and then search for status=ERROR.

Alternatively, you can create the field extraction yourself. This regular expression should do:

(?<date>\d\d\d\d-\w+-\d\d\s+\d\d:\d\d:\d\d\.\d\d\d)\s+(?<status>\w+)

You can test it here: https://regex101.com/r/pVg1Pm/1

Now use Splunk's rex command to do the field extraction at search time:

To have the field extraction done automatically, you can add new field extractions via Settings / Fields / Field extractions.