Getting Data In

If not condition in TIME_PREFIX

isha_rastogi
Path Finder

I am working in the FIX log messages and have two fields that contain timestamps. I need to check for one field and if that is not present check for other field. I'm facing problem if both of the fields is present.

Ex: I have 50=timestamp | 70=XYZ | 60=timestamp.

I am trying to extract timestamp from 60 if that not present then 52 but not able to write the regex if both are present because 50 is coming before 60 everytime so it's taking 50 field as timestamp.

TIME_PREFIX=(50=|60=)

Any idea how can I do that if both are present.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

TIME_PREFIX = ^.*(50=|60=)

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

TIME_PREFIX = ^.*(50=|60=)
0 Karma

isha_rastogi
Path Finder

Worked !!! Thanks 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,
did you tried using regexes in TIME_PREFIX?
something like this:

TIME_PREFIX = (50\=)|(60\=)

Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,
did you tried using regexes in TIME_PREFIX?
something like this:

TIME_PREFIX = (50\=)|(60\=)

Bye.
Giuseppe

0 Karma

isha_rastogi
Path Finder

yes, problem here is if either 50 or 60 is present then regex works like charm but if both are present I need to extract it from 60 . But as field 50 is always coming before 60 regex is breaking once it gets matching pattern. I tried using below regex but didn't work as it starts looking for 50 or 60 and whenever 50 comes it breaks never looks for 60
TIME_PREFIX = (60=)|(50=)

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,,
Try

(s?)(50\=)|(60\=)

using regex101.com I tested that when both the conditions are true, using (s?) the second one is preferred.
I don't know if this condition is applicable or not to TIME_PREFIX (in theory it should be a regex!).

Bye.
Giuseppe

0 Karma

isha_rastogi
Path Finder

I think you have selected global, so it's giving all the matches but in TIME_PREFIX we cant use that option

0 Karma

isha_rastogi
Path Finder

Hi cusello ,

thanks for your fast response. Not working for me as I can see its creating groups for both Group 1 for 50 group 2 for 60

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...