How to capture value between two dates and a time string?

[Splunkuser542]

Hi,

How can I capture the the text between the first and second date and time strings.

Using the example event below, I'd like to capture only "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam sodales nunc sit amet justo tristique, non consectetur quam accumsan. Maecenas aliquet massa a arcu condimentum, sit amet hendrerit tellus porttitor. Ut ultricies id odio at semper. help@lipsum.com".

Sometimes there will be no ending date and time as shown in Example 2 below.

Example 1:

16/08/2018 03:04:11 - Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam sodales nunc sit amet justo tristique, non consectetur quam accumsan. Maecenas aliquet massa a arcu condimentum, sit amet hendrerit tellus porttitor. Ut ultricies id odio at semper. help@lipsum.com 10/08/2018 07:11:53

Example 2 (no date and time at the end):

16/08/2018 03:04:11 - Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam sodales nunc sit amet justo tristique, non consectetur quam accumsan. Maecenas aliquet massa a arcu condimentum, sit amet hendrerit tellus porttitor. Ut ultricies id odio at semper. help@lipsum.com

I've created the following regex, but when I table the 'test' field, I don't have any resuts.

([0-9]{2}\/[0-9]{2}\/[0-9]{4}\s[0-9]{2}\:[0-9]{2}\:[0-9]{2}\s\-)(?P<test>.*)([0-9]{2}\/[0-9]{2}\/[0-9]{4}\s[0-9]{2}\:[0-9]{2}\:[0-9]{2})

Thanks!

[adonio]

hope i understood your requirement<

try this search anywhere:

| makeresults count=1
| eval data = "16/08/2018 03:04:11 - Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam sodales nunc sit amet justo tristique, non consectetur quam accumsan. Maecenas aliquet massa a arcu condimentum, sit amet hendrerit tellus porttitor. Ut ultricies id odio at semper. help@lipsum.com 10/08/2018 07:11:53; 16/08/2018 03:04:11 - Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam sodales nunc sit amet justo tristique, non consectetur quam accumsan. Maecenas aliquet massa a arcu condimentum, sit amet hendrerit tellus porttitor. Ut ultricies id odio at semper. help@lipsum.com"
| makemv delim=";" data 
| mvexpand data
| rename COMMENT as "the above generates data below is the solution" 
| rex field=data "\d{2}\/\d{2}\/\d{4}\s+\d{2}\:\d{2}\:\d{2}\s+\-\s+(?<message_test>[^|]+\w+\@\w+\.com)"
| table message_test

hope it helps

[Splunkuser542]

Hi adonio, sorry, I hope the below examples are more clear.

Example 1.

16/08/2018 03:04:11 - Some paragraph. 10/08/2018 07:11:53

Example 2.

18/08/2018 07:06:11 - Some sort of comment here. Email: test@email.com 04/08/2018 02:51:53

Example 3.

21/08/2018 09:15:11 - Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam sodales nunc sit amet justo tristique, non consectetur quam accumsan. 01/08/2018 07:47:53

I'd like to capture all the text in between the date and time string, which are (in order):

1. Some paragraph.
2. Some sort of comment here. Email: test@email.com
3. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam sodales nunc sit amet justo tristique, non consectetur quam accumsan.

Thanks in advance.