REGEX for separate DATE and TIME

[chamil3001]

Hi,

I have this log file with

Start date and time 2/27/2011 11:44:02 PM

End date and time 3/28/2011 11:56:56 PM

I need to extract the Fields as follows. START_DATE,START_TIME and END_DATE,END_TIME.

My IFX regex (?i)^(?:[^\t]\t){10}(?P[^ ]+)* will select the date but how to
separate the START_DATE and END_DATE with REGEX?

Please drop me some examples..
Thanks in advance

Chamil

[eashwar]

find your the sourcetype associated with the log in splunk/etc/apps/your app name(search or any custom app)/local/props.conf

[yoursourcetype]  
EXTRACT-startdatetime=(?i)Start\sdate\sand\stime\s(?P<StartDate>\d{1,2}/\d{1,2}/\d{1,4})\s+(?P<StartTime>\d{1,2}:\d{1,2}:\d{1,2}\s\S{2})
EXTRACT-enddatetime=(?i)End\sdate\sand\stime\s(?P<EndDate>\d{1,2}/\d{1,2}/\d{1,4})\s+(?P<EndTime>\d{1,2}:\d{1,2}:\d{1,2}\s\S{2})

append the two lines(EXTRACT) under your sourcetype name, be very careful and make sure that the EVENTS sourcetype matches the one inside the square brackets. If you cant find just create one with the values.

make sure you also check the props.conf in splunk/etc/system/local/ and splunk/user/admin(or your username)/appname(search or custom app)/local/

if you still have some problem
comment.. i will help you.
happy splunking!!!

[eashwar]

hey NVM,
consider voting if it helped you.
thanks, happy splunking

[chamil3001]

thank you very much.. appreciate it

[bmacias84]

Ok I am familar with this type of Log(OFX mostly). Currently are those two lines one event or two? Does every event in your logs start that way?

[martin_mueller]

What does the entire event look like?