TIMESTAMP QUERY

[srajanbabu]

I have my log as
SNM4 PGHF14LR.866F :: 04/03/13 11:46:32 :: Received file MOBIUSJ741.20130403 - 317982 bytes transferred
SNM4 TDAM1EBY.864F :: 04/03/13 11:46:34 :: Execute_profile_recs: Submitting ftp trans due to quit command
SNM4 TDAM1EBY.864F :: 04/03/13 11:46:36 :: Execute_profile_recs: Issuing Put of TDAMUSA_20130403_1147.enc to 'MD.B.DMVR.DV180-50.TDAM1EBY(+1)'

From this i want to extract only the timestamp at which the recieve file event has taken place like
want the result as
timestamp bytes transferred
04/03/13 11:46:32 317982 bytes transferred

[kristian_kolb]

Isn't this information already present in the _time field? If not, or if you need to extract it anyway;

index=blah sourcetpe=bleh "Received file" 
| rex "::\s(?<timestamp>\S+\s\S+)\s::" 
| rex "\s(?<bytes>\d+)\sbytes\stransferred$"
| table timestamp bytes

If you can use the default extracted time (in _time) then just skip the first rex and use _time in the table instead of timestamp.

Hope this helps,

K