https://community.splunk.com/t5/Splunk-Search/How-to-extract-logs-by-rex/m-p/366899#M161173 <P>Try this:</P> <PRE><CODE>_your_search_ | rex "\"TranStartTime\":\"(?P&lt;tranStartTime&gt;[^\"]*)\",\s\"TranEndTime\":\"(?P&lt;tranEndTime&gt;[^\"]*)\"" </CODE></PRE> Mon, 08 May 2017 18:48:45 GMT cpetterborg 2017-05-08T18:48:45Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-logs-by-rex/m-p/366898#M161172 <P>How to extract logs by rex ?<BR /> "TranStartTime":"2017-05-08T02:40:58.856-04:00", "TranEndTime":"2017-05-08T02:40:58.902-04:00"</P> <P>need to TranStartTime and TranEndTime</P> Mon, 08 May 2017 06:46:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-logs-by-rex/m-p/366898#M161172 karthi2809 2017-05-08T06:46:52Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-logs-by-rex/m-p/366899#M161173 <P>Try this:</P> <PRE><CODE>_your_search_ | rex "\"TranStartTime\":\"(?P&lt;tranStartTime&gt;[^\"]*)\",\s\"TranEndTime\":\"(?P&lt;tranEndTime&gt;[^\"]*)\"" </CODE></PRE> Mon, 08 May 2017 18:48:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-logs-by-rex/m-p/366899#M161173 cpetterborg 2017-05-08T18:48:45Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-logs-by-rex/m-p/366900#M161174 <P>I'd probably put them in two separate rexes, just in case they ever arrived in a different order or separated by something else. Upvoted anyway, it works per regex101.com.</P> Mon, 08 May 2017 21:27:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-logs-by-rex/m-p/366900#M161174 DalJeanis 2017-05-08T21:27:03Z