How to get data into different variables on similar data lines

[arunslal]

I have got two timestamps. Can anyone please help me extract these 2 timestamps into different fields?

08/02/2019 15:25:30.084 (ID=8238) (Line=4203) Sent ->PJ;1;2;;COMMON;rfscCpackageScan;Y;1;1;;0;Y;<-
08/01/2019 10:38:51.377 (ID=45804) (Line=4229) Received ->PJ;81;S;SUCCESS;<-

The first timestamp needs to be extracted into SentTime field (this line has text Sent in it)
The Second timestamp needs to be extracted into ReceivedTime field (this line has text Received in it)

Basically, I am looking for the below:
SentTime = 08/02/2019 15:25:30.084
ReceivedTime = 08/01/2019 10:38:51.377

When I try to extract directly, both the timestamp goes into same field extraction...

Thanks in advance for the help!

Cheers,
Arun

[richgalloway · Accepted solution]

Try this

... | rex "(?<SentTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sSent" | rex "(?<ReceivedTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sReceived" | ...

[arunslal]

Thanks a lot !! It worked 🙂