Can you help me create a regex expression that captures text with a comma?

[JoshuaJohn]

I have this log:

2139,A-1112,74,01:11:71:E1:A1:C1,store,store@store.net,Nitro,Enroll,nitrofire Enroll,,Windows ,Redblue - B111.B4321,,C,1.1.3213,5/4/2018 7:23,Compliant,Enrolled,,MDM,9/20/2018 4:43,,No ,N/A,United States,Yes,00000000A6C344A354543534535345CEBD4A928D,000-88,,No,3/9/2018 17:38,9/20/2018 4:30

I am trying to capture "9/20/2018 4:43". The characters "MDM," will always be there before the date/time. It will also always end with a comma.

Any ideas?

[cpetterborg]

You have not said whether or not you need to get this data at search time or index time, so I'm going to assume search time (since that is Splunk Best Practice. Here is a run anywhere search that shows how you can do the field extraction. I leave it up to you to decide how you will implement the regular expression, whether it be in an automatic field extraction, or done as an inline search:

| makeresults
| eval data="2139,A-1112,74,01:11:71:E1:A1:C1,store,store@store.net,Nitro,Enroll,nitrofire Enroll,,Windows ,Redblue - B111.B4321,,C,1.1.3213,5/4/2018 7:23,Compliant,Enrolled,,MDM,9/20/2018 4:43,,No ,N/A,United States,Yes,00000000A6C344A354543534535345CEBD4A928D,000-88,,No,3/9/2018 17:38,9/20/2018 4:30"
| rex field=data "MDM,(?<datefield>[^,]*),"

The rex portion is the only part that you would really need to be concerned with from the above search, as it gives you the regular expression that you need.

[hcheang]

Try

| rex "MDM,(?<tmp>[^,]+),"