topic Re: Help with rex expression to capture time in Splunk Search https://community.splunk.com/t5/Splunk-Search/Help-with-rex-expression-to-capture-time/m-p/158533#M44675 <P>Thx for the input. i have tried the other solution and it worked.</P> Fri, 25 Jul 2014 19:28:45 GMT xvxt006 2014-07-25T19:28:45Z Help with rex expression to capture time https://community.splunk.com/t5/Splunk-Search/Help-with-rex-expression-to-capture-time/m-p/158530#M44672 <P>Hi,</P> <P>i have an event like below after ms there is a line break and some other text. <BR /> i want to capture that time. i have tried the below expression but it did not work. Any suggestions? </P> <P>INFO: Server will startup in 2131 ms<BR /> sdfsfsdfsdfsff</P> <P>expression i have used: rex field=_raw "(?i) .<EM>? Server will startup in (?P<FIELDNAME>.</FIELDNAME></EM>?)(?=ms)"</P> Fri, 25 Jul 2014 19:04:48 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-rex-expression-to-capture-time/m-p/158530#M44672 xvxt006 2014-07-25T19:04:48Z Re: Help with rex expression to capture time https://community.splunk.com/t5/Splunk-Search/Help-with-rex-expression-to-capture-time/m-p/158531#M44673 <P>Just needed a slight adjustment to your regex:</P> <PRE><CODE>(?P&lt;fieldname&gt;\d+)(?=\sms) </CODE></PRE> Fri, 25 Jul 2014 19:17:58 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-rex-expression-to-capture-time/m-p/158531#M44673 sbrant_splunk 2014-07-25T19:17:58Z Re: Help with rex expression to capture time https://community.splunk.com/t5/Splunk-Search/Help-with-rex-expression-to-capture-time/m-p/158532#M44674 <P>INFO: Server will startup in (.*)</P> <P>I tried it in pythex and it worked</P> Fri, 25 Jul 2014 19:22:48 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-rex-expression-to-capture-time/m-p/158532#M44674 strive 2014-07-25T19:22:48Z Re: Help with rex expression to capture time https://community.splunk.com/t5/Splunk-Search/Help-with-rex-expression-to-capture-time/m-p/158533#M44675 <P>Thx for the input. i have tried the other solution and it worked.</P> Fri, 25 Jul 2014 19:28:45 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-rex-expression-to-capture-time/m-p/158533#M44675 xvxt006 2014-07-25T19:28:45Z Re: Help with rex expression to capture time https://community.splunk.com/t5/Splunk-Search/Help-with-rex-expression-to-capture-time/m-p/158534#M44676 <P>Thx. This worked</P> Fri, 25 Jul 2014 19:28:55 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-rex-expression-to-capture-time/m-p/158534#M44676 xvxt006 2014-07-25T19:28:55Z