Getting Data In

If not condition in TIME_PREFIX

isha_rastogi
Path Finder

I am working in the FIX log messages and have two fields that contain timestamps. I need to check for one field and if that is not present check for other field. I'm facing problem if both of the fields is present.

Ex: I have 50=timestamp | 70=XYZ | 60=timestamp.

I am trying to extract timestamp from 60 if that not present then 52 but not able to write the regex if both are present because 50 is coming before 60 everytime so it's taking 50 field as timestamp.

TIME_PREFIX=(50=|60=)

Any idea how can I do that if both are present.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

TIME_PREFIX = ^.*(50=|60=)

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

TIME_PREFIX = ^.*(50=|60=)
0 Karma

isha_rastogi
Path Finder

Worked !!! Thanks 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,
did you tried using regexes in TIME_PREFIX?
something like this:

TIME_PREFIX = (50\=)|(60\=)

Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,
did you tried using regexes in TIME_PREFIX?
something like this:

TIME_PREFIX = (50\=)|(60\=)

Bye.
Giuseppe

0 Karma

isha_rastogi
Path Finder

yes, problem here is if either 50 or 60 is present then regex works like charm but if both are present I need to extract it from 60 . But as field 50 is always coming before 60 regex is breaking once it gets matching pattern. I tried using below regex but didn't work as it starts looking for 50 or 60 and whenever 50 comes it breaks never looks for 60
TIME_PREFIX = (60=)|(50=)

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,,
Try

(s?)(50\=)|(60\=)

using regex101.com I tested that when both the conditions are true, using (s?) the second one is preferred.
I don't know if this condition is applicable or not to TIME_PREFIX (in theory it should be a regex!).

Bye.
Giuseppe

0 Karma

isha_rastogi
Path Finder

I think you have selected global, so it's giving all the matches but in TIME_PREFIX we cant use that option

0 Karma

isha_rastogi
Path Finder

Hi cusello ,

thanks for your fast response. Not working for me as I can see its creating groups for both Group 1 for 50 group 2 for 60

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...