Splunk Search

How to select second date string from email?

Path Finder

Currently, our support team is sent an email that reports start and end times for jobs. It comes from an ancient system so the report cannot be updated. I need to extract jobname, start date/time, end date/time and status. I am having trouble extracting the second date/time. Can someone assist, please?

Here is an example of the email -

JOB RUN REPORT
Jobname Last Start Last End Status
job#1 2018/03/02 23:00:00 2018/03/02 23:01:00 SU
job#2 2018/03/02 23:01:01 2018/03/02 23:01:50 SU
job#3 2018/03/02 23:02:01 2018/03/02 23:03:50 FA
etc etc

These are my rex's to collect the date/time fields - please be gentle, this is my first effort at regex & rex in Splunk.

To Collect the start -
| rex field=_raw "(?(...([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})))" max_match=0

To Collect the end - this is the one that isn't working because it gets the last digit from the start time.

| rex field=_raw "(?([0-9]..([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})))" max_match=0

Please let me know if anything needs more explanation. Thanks

0 Karma
1 Solution

Legend

@timrich66, you can write a single rex to extract all the fields you are interested in. Following is a run anywhere search example based on the same data provided above. Instead of the makeresults and eval commands you would need to use your base search to test with the actual data.

| makeresults
| eval _raw="job#1 2018/03/02 23:00:00 2018/03/02 23:01:00 SU
job#2 2018/03/02 23:01:01 2018/03/02 23:01:50 SU
job#3 2018/03/02 23:02:01 2018/03/02 23:03:50 FA"
| rex "job#(?<job_num>[^\s]+)\s(?<start_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<end_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<status>\w+)" max_match=0

PS: For testing and picking up on regular expressions you should check out regex101.com

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Legend

@timrich66, you can write a single rex to extract all the fields you are interested in. Following is a run anywhere search example based on the same data provided above. Instead of the makeresults and eval commands you would need to use your base search to test with the actual data.

| makeresults
| eval _raw="job#1 2018/03/02 23:00:00 2018/03/02 23:01:00 SU
job#2 2018/03/02 23:01:01 2018/03/02 23:01:50 SU
job#3 2018/03/02 23:02:01 2018/03/02 23:03:50 FA"
| rex "job#(?<job_num>[^\s]+)\s(?<start_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<end_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<status>\w+)" max_match=0

PS: For testing and picking up on regular expressions you should check out regex101.com

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Path Finder

Thanks,@niketnilay, I've got that working now.

0 Karma

Legend

@timrich66, glad you got it working. Please accept the answer to mark this question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!