$error = '2014-06-04T15:24:21-05:00 syslog_dp [0x80e00099][ftp][error] secure-backup(FBB): trans(5487)'; $time = (split /\s/, $error)[0]; print $time, "\n"; # or you could do this: ($time) = $error =~ /^(\S+)/; print $time, "\n";