Getting Data In

How to get data into different variables on similar data lines

arunslal
Loves-to-Learn Lots

I have got two timestamps. Can anyone please help me extract these 2 timestamps into different fields?

08/02/2019 15:25:30.084 (ID=8238) (Line=4203) Sent ->PJ;1;2;;COMMON;rfscCpackageScan;Y;1;1;;0;Y;<-
08/01/2019 10:38:51.377 (ID=45804) (Line=4229) Received ->PJ;81;S;SUCCESS;<-

The first timestamp needs to be extracted into SentTime field (this line has text Sent in it)
The Second timestamp needs to be extracted into ReceivedTime field (this line has text Received in it)

Basically, I am looking for the below:
SentTime = 08/02/2019 15:25:30.084
ReceivedTime = 08/01/2019 10:38:51.377

When I try to extract directly, both the timestamp goes into same field extraction...

Thanks in advance for the help!

Cheers,
Arun

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this

... | rex "(?<SentTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sSent" | rex "(?<ReceivedTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sReceived" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | rex "(?<SentTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sSent" | rex "(?<ReceivedTime>.*?)\s\(ID=\d+\)\s\(Line=\d+\)\sReceived" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

arunslal
Loves-to-Learn Lots

Thanks a lot !! It worked 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...