Getting Data In

How to get data into different variables on similar data lines

arunslal
Loves-to-Learn Lots

I have got two timestamps. Can anyone please help me extract these 2 timestamps into different fields?

08/02/2019 15:25:30.084 (ID=8238) (Line=4203) Sent ->PJ;1;2;;COMMON;rfscCpackageScan;Y;1;1;;0;Y;<-
08/01/2019 10:38:51.377 (ID=45804) (Line=4229) Received ->PJ;81;S;SUCCESS;<-

The first timestamp needs to be extracted into SentTime field (this line has text Sent in it)
The Second timestamp needs to be extracted into ReceivedTime field (this line has text Received in it)

Basically, I am looking for the below:
SentTime = 08/02/2019 15:25:30.084
ReceivedTime = 08/01/2019 10:38:51.377

When I try to extract directly, both the timestamp goes into same field extraction...

Thanks in advance for the help!

Cheers,
Arun

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this

... | rex "(?<SentTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sSent" | rex "(?<ReceivedTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sReceived" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | rex "(?<SentTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sSent" | rex "(?<ReceivedTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sReceived" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

arunslal
Loves-to-Learn Lots

Thanks a lot !! It worked 🙂

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...