How to create a regex for unmapped queries?

[Nidd]

I have Splunk logs like:

class,method,user,transactionType,,428856645467856301,1073258159,50213,5,2019-08-21 23:17:58.562,2019-08-21 23:17:58.994,432,,,,4,45170632,19634442,,,,159,52297220,801767,,,,,,,b4a954df-8c77-4a30-b4ac-68ec9afe9a48,,,,TransactionType=transactionType|

There would be many many logs of this format.

I now need to extract a couple of timestamps and populate in a table. Eg: '2019-08-21 23:17:58.562' and '2019-08-21 23:17:58.994,432' from the above log and display as:
-------------------------------------------------------------------
StartTime EndTime
-------------------------------------------------------------------
2019-08-21 23:17:58.562 2019-08-21 23:17:58.994
-------------------------------------------------------------------

Can someone please help?

[Nidd]

Found this:

<mySearch> | rex "^(?:(?<TransactionStartTime>[^,]*),){10}" | rex "^(?:(?<TransactionEndTime>[^,]*),){11}" | table TransactionStartTime, TransactionEndTime

[nareshinsvu · Accepted solution]

Try this: Keep in mind that this only helps if the time placements are at the same position for all your log content. If your input is of csv format with all headers, extraction would have been easy

|makeresults
|eval _raw="class,method,user,transactionType,,428856645467856301,1073258159,50213,5,2019-08-21 23:17:58.562,2019-08-21 23:17:58.994,432,,,,4,45170632,19634442,,,,159,52297220,801767,,,,,,,b4a954df-8c77-4a30-b4ac-68ec9afe9a48,,,,TransactionType=transactionType" 
|eval fields=split(_raw,",") 
| eval Start_time=mvindex(fields,9), End_time=mvindex(fields,10) 
| table Start_time End_time

[Nidd]

Yes. I understand Naresh. Thanks for your answer. I accept your answer as well.