Getting Data In

If not condition in TIME_PREFIX

isha_rastogi
Path Finder

I am working in the FIX log messages and have two fields that contain timestamps. I need to check for one field and if that is not present check for other field. I'm facing problem if both of the fields is present.

Ex: I have 50=timestamp | 70=XYZ | 60=timestamp.

I am trying to extract timestamp from 60 if that not present then 52 but not able to write the regex if both are present because 50 is coming before 60 everytime so it's taking 50 field as timestamp.

TIME_PREFIX=(50=|60=)

Any idea how can I do that if both are present.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

TIME_PREFIX = ^.*(50=|60=)

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

TIME_PREFIX = ^.*(50=|60=)
0 Karma

isha_rastogi
Path Finder

Worked !!! Thanks 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,
did you tried using regexes in TIME_PREFIX?
something like this:

TIME_PREFIX = (50\=)|(60\=)

Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,
did you tried using regexes in TIME_PREFIX?
something like this:

TIME_PREFIX = (50\=)|(60\=)

Bye.
Giuseppe

0 Karma

isha_rastogi
Path Finder

yes, problem here is if either 50 or 60 is present then regex works like charm but if both are present I need to extract it from 60 . But as field 50 is always coming before 60 regex is breaking once it gets matching pattern. I tried using below regex but didn't work as it starts looking for 50 or 60 and whenever 50 comes it breaks never looks for 60
TIME_PREFIX = (60=)|(50=)

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,,
Try

(s?)(50\=)|(60\=)

using regex101.com I tested that when both the conditions are true, using (s?) the second one is preferred.
I don't know if this condition is applicable or not to TIME_PREFIX (in theory it should be a regex!).

Bye.
Giuseppe

0 Karma

isha_rastogi
Path Finder

I think you have selected global, so it's giving all the matches but in TIME_PREFIX we cant use that option

0 Karma

isha_rastogi
Path Finder

Hi cusello ,

thanks for your fast response. Not working for me as I can see its creating groups for both Group 1 for 50 group 2 for 60

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...