<p>I have &quot;YYYY-MM-DD HH:MM:SS.QQ ERROR&quot; in my splunk logs.
Now I want to search for similar date pattern along with Status like &quot;2021-Apr-08 23:08:23.498 ERROR&quot; in my splunk logs and create alert if the ERROR tag comes next to the date.
These date are changeable and are generated at run time.</p>
<p>Can any one suggest me how to check for Date time format along with Status in splunk query.</p>

knowledge20
<p>In the title you mentioned Amazon Web Services. If your events are actual AWS log data, you could install the <code>Splunk Add-on for Amazon Web Services</code>: <a href="https://splunkbase.splunk.com/app/1876/" rel="nofollow noreferrer">https://splunkbase.splunk.com/app/1876/</a></p>
<p>The add-on comes with a lot of field extractions. After installing the add-on, all you need to do is have a look at your events to find out the correct field name for the status text and then search for <code>status=ERROR</code>.</p>
<p>Alternatively, you can create the field extraction yourself. This regular expression should do:</p>
<pre><code>(?&lt;date&gt;\d\d\d\d-\w+-\d\d\s+\d\d:\d\d:\d\d\.\d\d\d)\s+(?&lt;status&gt;\w+)
</code></pre>
<p>You can test it here: <a href="https://regex101.com/r/pVg1Pm/1" rel="nofollow noreferrer">https://regex101.com/r/pVg1Pm/1</a></p>
<p>Now use Splunk's <code>rex</code> command to do the field extraction at search time:</p>
<p><a href="https://i.stack.imgur.com/Esuis.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Esuis.png" alt="Screenshot" /></a></p>
<p>To have the field extraction done automatically, you can add new field extractions via Settings / Fields / Field extractions.</p>
