How to select second date string from email?

[timrich66]

Currently, our support team is sent an email that reports start and end times for jobs. It comes from an ancient system so the report cannot be updated. I need to extract jobname, start date/time, end date/time and status. I am having trouble extracting the second date/time. Can someone assist, please?

Here is an example of the email -

JOB RUN REPORT
Jobname Last Start Last End Status
job#1 2018/03/02 23:00:00 2018/03/02 23:01:00 SU
job#2 2018/03/02 23:01:01 2018/03/02 23:01:50 SU
job#3 2018/03/02 23:02:01 2018/03/02 23:03:50 FA
etc etc

These are my rex's to collect the date/time fields - please be gentle, this is my first effort at regex & rex in Splunk.

To Collect the start -
| rex field=_raw "(?(...([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})))" max_match=0

To Collect the end - this is the one that isn't working because it gets the last digit from the start time.

| rex field=_raw "(?([0-9]..([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})))" max_match=0

Please let me know if anything needs more explanation. Thanks

[niketn · Accepted solution]

@timrich66, you can write a single rex to extract all the fields you are interested in. Following is a run anywhere search example based on the same data provided above. Instead of the makeresults and eval commands you would need to use your base search to test with the actual data.

| makeresults
| eval _raw="job#1 2018/03/02 23:00:00 2018/03/02 23:01:00 SU
job#2 2018/03/02 23:01:01 2018/03/02 23:01:50 SU
job#3 2018/03/02 23:02:01 2018/03/02 23:03:50 FA"
| rex "job#(?<job_num>[^\s]+)\s(?<start_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<end_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<status>\w+)" max_match=0

PS: For testing and picking up on regular expressions you should check out regex101.com

[timrich66]

Thanks,@niketnilay, I've got that working now.

[niketn]

@timrich66, glad you got it working. Please accept the answer to mark this question as answered.