Getting Data In
Highlighted

How to get data into different variables on similar data lines

New Member

I have got two timestamps. Can anyone please help me extract these 2 timestamps into different fields?

08/02/2019 15:25:30.084 (ID=8238) (Line=4203) Sent ->PJ;1;2;;COMMON;rfscCpackageScan;Y;1;1;;0;Y;<-
08/01/2019 10:38:51.377 (ID=45804) (Line=4229) Received ->PJ;81;S;SUCCESS;<-

The first timestamp needs to be extracted into SentTime field (this line has text Sent in it)
The Second timestamp needs to be extracted into ReceivedTime field (this line has text Received in it)

Basically, I am looking for the below:
SentTime = 08/02/2019 15:25:30.084
ReceivedTime = 08/01/2019 10:38:51.377

When I try to extract directly, both the timestamp goes into same field extraction...

Thanks in advance for the help!

Cheers,
Arun

0 Karma
Highlighted

Re: How to get data into different variables on similar data lines

SplunkTrust
SplunkTrust

Try this

... | rex "(?<SentTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sSent" | rex "(?<ReceivedTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sReceived" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: How to get data into different variables on similar data lines

New Member

Thanks a lot !! It worked 🙂

0 Karma