https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-different-variables-on-similar-data-lines/m-p/456363#M78906 <P>Thanks a lot !! It worked <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 19 Aug 2019 13:21:56 GMT arunslal 2019-08-19T13:21:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-different-variables-on-similar-data-lines/m-p/456361#M78904 <P>I have got two timestamps. Can anyone please help me extract these 2 timestamps into different fields?</P> <P>08/02/2019 15:25:30.084 (ID=8238) (Line=4203) Sent -&gt;PJ;1;2;;COMMON;rfscCpackageScan;Y;1;1;;0;Y;&lt;-<BR /> 08/01/2019 10:38:51.377 (ID=45804) (Line=4229) Received -&gt;PJ;81;S;SUCCESS;&lt;-</P> <P>The first timestamp needs to be extracted into SentTime field (this line has text Sent in it)<BR /> The Second timestamp needs to be extracted into ReceivedTime field (this line has text Received in it)</P> <P>Basically, I am looking for the below:<BR /> SentTime = 08/02/2019 15:25:30.084<BR /> ReceivedTime = 08/01/2019 10:38:51.377</P> <P>When I try to extract directly, both the timestamp goes into same field extraction... </P> <P>Thanks in advance for the help!</P> <P>Cheers,<BR /> Arun</P> Mon, 19 Aug 2019 11:25:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-different-variables-on-similar-data-lines/m-p/456361#M78904 arunslal 2019-08-19T11:25:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-different-variables-on-similar-data-lines/m-p/456362#M78905 <P>Try this</P> <PRE><CODE>... | rex "(?&lt;SentTime&gt;.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sSent" | rex "(?&lt;ReceivedTime&gt;.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sReceived" | ... </CODE></PRE> Mon, 19 Aug 2019 13:02:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-different-variables-on-similar-data-lines/m-p/456362#M78905 richgalloway 2019-08-19T13:02:43Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-different-variables-on-similar-data-lines/m-p/456363#M78906 <P>Thanks a lot !! It worked <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 19 Aug 2019 13:21:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-different-variables-on-similar-data-lines/m-p/456363#M78906 arunslal 2019-08-19T13:21:56Z