Getting Data In

If not condition in TIME_PREFIX

isha_rastogi
Path Finder

I am working in the FIX log messages and have two fields that contain timestamps. I need to check for one field and if that is not present check for other field. I'm facing problem if both of the fields is present.

Ex: I have 50=timestamp | 70=XYZ | 60=timestamp.

I am trying to extract timestamp from 60 if that not present then 52 but not able to write the regex if both are present because 50 is coming before 60 everytime so it's taking 50 field as timestamp.

TIME_PREFIX=(50=|60=)

Any idea how can I do that if both are present.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

TIME_PREFIX = ^.*(50=|60=)

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

TIME_PREFIX = ^.*(50=|60=)
0 Karma

isha_rastogi
Path Finder

Worked !!! Thanks 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,
did you tried using regexes in TIME_PREFIX?
something like this:

TIME_PREFIX = (50\=)|(60\=)

Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,
did you tried using regexes in TIME_PREFIX?
something like this:

TIME_PREFIX = (50\=)|(60\=)

Bye.
Giuseppe

0 Karma

isha_rastogi
Path Finder

yes, problem here is if either 50 or 60 is present then regex works like charm but if both are present I need to extract it from 60 . But as field 50 is always coming before 60 regex is breaking once it gets matching pattern. I tried using below regex but didn't work as it starts looking for 50 or 60 and whenever 50 comes it breaks never looks for 60
TIME_PREFIX = (60=)|(50=)

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi isha_rastogi,,
Try

(s?)(50\=)|(60\=)

using regex101.com I tested that when both the conditions are true, using (s?) the second one is preferred.
I don't know if this condition is applicable or not to TIME_PREFIX (in theory it should be a regex!).

Bye.
Giuseppe

0 Karma

isha_rastogi
Path Finder

I think you have selected global, so it's giving all the matches but in TIME_PREFIX we cant use that option

0 Karma

isha_rastogi
Path Finder

Hi cusello ,

thanks for your fast response. Not working for me as I can see its creating groups for both Group 1 for 50 group 2 for 60

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...