Extracting two fields from a log row

[perseger]

Hi,
I have problem extracting fields from a log where the first field is in the beginning of the row. I want to extract the time when the the row was logged (LOGTIME) and the timestamp from the application (STARTTIME). Any clue how to do that?

My query (which doesn't work):

index=xxx source=yyy | rex "^(?P[^,]+)(?i) startTime=(?P[^&]+)"

Sample log row:

2012-04-23 04:58:48,142 [xxx.yyy.zzz.vvv] 123 /functionname 123 ms / startTime=1327312727&dataX=XXX&dataY=2371316&endTime=1335175127&dataZ=1&dataW=YYY / result=1234567

Any help is appreciated!

[kristian_kolb]

Do you really need to make a separate extraction for those???

If the first timestamp is used by Splunk for indexing, it's automatically available in the internal _time field.

Unless you have turned off automatic field extraction, the startTime should be extracted as well, since it's a regular key=value format.

Note: you may have to use the strftime function for eval when presenting date/time to make it nicer to read for a human.

Hope this helps,

Kristian

[perseger]

Great, _time will work for me.
logtime will be same as _time in my application
Thanks!

[Ayn · Accepted solution]

You're forgetting to match the text between the logtime and the starttime. This should do it:

^(?<logtime>[^,]+).+?startTime=(?<starttime>\d+)

I usually use something like regexpal or RegExr to try out regexes.

[perseger]

It works! Thanks!