Looking for an efficient Regex to capture the string following the time stamp in the following:

<38>Oct 10 14:32:29 UAT01 
<86>Oct 10 14:32:29 Test04 
<13>Oct 10 14:35:09 Dev02
<13>Oct 10 14:35:10 Test03
  • It's for extracting specific data from logs. I know how to capture the timestamp - regex101.com/r/hkyh08/1 – Heisenberg Oct 10 '18 at 21:07
  • Needs to be Regex. It is for a SIEM. Need to capture the hostname that always appears after the timestamp in the logs. – Heisenberg Oct 10 '18 at 21:11
  • That is correct. Looking for the proper way to capture the string that immediately follows the timestamp. – Heisenberg Oct 10 '18 at 21:14

Given that the question is asking for a regex specifically:

grep -Eo '\s(\w+).$' file



`\s` matches any whitespace character.
`(\w+)` is the first Capturing Group 
 `\w+` matches any word character  and it is equal to [a-zA-Z0-9_]
 `+ ` Quantifier — Matches between one and unlimited times, as many times as possible.
 `.` matches any character (except for line terminators)
 `$` asserts position at the end of the string, or before the line terminator right at the end of the string.

The last strings can be extracted much easier using cut or awk

cut -d' ' -f 7 file

awk '{print $7}' file

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.