https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178665#M51393 <PRE><CODE>rex field=_raw "*\s+(?P&lt;Start_date&gt;\S+)\s+" </CODE></PRE> <P>should give you the time value.</P> <PRE><CODE>rex field=_raw "(?P&lt;ROLLS&gt;num_rows:\s+\d+)" </CODE></PRE> <P>This will get the ROLLS.</P> <P>But you would want <CODE>num_rows = 65931447</CODE> right? for that.. </P> <PRE><CODE>rex field=_raw "num_rows:\s+(?P&lt;num_rows&gt;\d+)\," </CODE></PRE> <P>Didn't test these. Should be good though.</P> Tue, 17 Mar 2015 17:34:58 GMT theouhuios 2015-03-17T17:34:58Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178663#M51391 <P>Hello guys, sup?</P> <P>We've got this piece of log which is a MySql log and we should not change the layout, but need to extract <CODE>START_DATE</CODE>, <CODE>END_DATE</CODE> and <CODE>NUM_ROWS</CODE>.<BR /> As follows a piece of data:</P> <PRE><CODE>****************************************************** ***************** EXECUTION HYW ***************** ***************** TRTD08IIL.SQL ***************** ****************************************************** *************** 26/02/2015-07:00:06 *************** Conectting to MYSQL Execution Data Process Code : TRTD08IIL Program : TRTD08IIL.SQL Descripton : Table Critic : E Reference Date : 20140103 *************** 26/02/2015-07:00:06 *************** Temp Execution Path For File: /C:/TEMP/TRTD08IIL.SQL.TRTD08IIL *************** 26/02/2015-07:00:06 *************** Temp Execution Path For File: /C:/TEMP/TRTD08IIL.SQL.TRTD08IIL Table tb.User stats: [num_partitions: 0, num_files: 0, num_rows: 65931447, total_size: 0, raw_data_size: 15793929087] 65931447 Rows loaded to tab_clie MapReduce Jobs Launched: Job 0: Map: 18 Reduce: 4 Cumulative CPU: 608.98 sec HDFS Read: 1037601634 HDFS Write: 604987045 SUCCESS Job 1: Map: 59 Reduce: 58 Cumulative CPU: 4337.55 sec HDFS Read: 14707612009 HDFS Write: 29413721 SUCCESS Total MapReduce CPU Time Spent: 0 days 7 hours 59 minutes 42 seconds 920 msec OK Time taken: 2256.431 seconds *************** 26/02/2015-07:37:47 *************** Temp Execution Path For File: /C:/TEMP/TRTD08IIL.SQL.TRTD08IIL *************** 26/02/2015-07:37:47 *************** Temp Execution Path For File: /C:/TEMP/TRTD08IIL.SQL.TRTD08IIL </CODE></PRE> Tue, 17 Mar 2015 17:23:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178663#M51391 vtsguerrero 2015-03-17T17:23:59Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178664#M51392 <P>I need to extract by regex <BR /> should be:</P> <P>START_DATE = *************** 26/02/2015-07:00:06 ***************<BR /> END_DATE = *************** 26/02/2015-07:37:47 ***************<BR /> ROLLS = num_rows: 65931447</P> Mon, 28 Sep 2020 19:10:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178664#M51392 vtsguerrero 2020-09-28T19:10:40Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178665#M51393 <PRE><CODE>rex field=_raw "*\s+(?P&lt;Start_date&gt;\S+)\s+" </CODE></PRE> <P>should give you the time value.</P> <PRE><CODE>rex field=_raw "(?P&lt;ROLLS&gt;num_rows:\s+\d+)" </CODE></PRE> <P>This will get the ROLLS.</P> <P>But you would want <CODE>num_rows = 65931447</CODE> right? for that.. </P> <PRE><CODE>rex field=_raw "num_rows:\s+(?P&lt;num_rows&gt;\d+)\," </CODE></PRE> <P>Didn't test these. Should be good though.</P> Tue, 17 Mar 2015 17:34:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178665#M51393 theouhuios 2015-03-17T17:34:58Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178666#M51394 <P>Sorry about that. Been a while since I posted here. Looks like formatting got messed up.</P> Tue, 17 Mar 2015 17:48:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178666#M51394 theouhuios 2015-03-17T17:48:30Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178667#M51395 <P>Is data already ingested and all these lines appear as one event?</P> Tue, 17 Mar 2015 18:19:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178667#M51395 somesoni2 2015-03-17T18:19:33Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178668#M51396 <P>Yeah, max_event was applied with 10.000 in index preview...</P> Tue, 17 Mar 2015 18:20:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178668#M51396 vtsguerrero 2015-03-17T18:20:24Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178669#M51397 <P>This works on regex101.com:</P> <PRE><CODE>"(?s)\*{15}\s+(?P&lt;START_DATE&gt;\d\d\/\d\d\/\d{4}-\d\d:\d\d:\d\d)\s+\*{15}.*\s(?P&lt;NUM_ROWS&gt;\d+)\sRows loaded.*Time taken: .*?seconds.*?\*{15}\s+(?&lt;END_DATE&gt;\d\d\/\d\d\/\d{4}-\d\d:\d\d:\d\d)" </CODE></PRE> Tue, 17 Mar 2015 19:18:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178669#M51397 richgalloway 2015-03-17T19:18:19Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178670#M51398 <P>Thanks @richgalloway! Worked here!</P> Tue, 17 Mar 2015 19:30:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-date-fields-and-another/m-p/178670#M51398 vtsguerrero 2015-03-17T19:30:39Z