Splunk Search

How to select second date string from email?

timrich66
Communicator

Currently, our support team is sent an email that reports start and end times for jobs. It comes from an ancient system so the report cannot be updated. I need to extract jobname, start date/time, end date/time and status. I am having trouble extracting the second date/time. Can someone assist, please?

Here is an example of the email -

JOB RUN REPORT
Jobname Last Start Last End Status
job#1 2018/03/02 23:00:00 2018/03/02 23:01:00 SU
job#2 2018/03/02 23:01:01 2018/03/02 23:01:50 SU
job#3 2018/03/02 23:02:01 2018/03/02 23:03:50 FA
etc etc

These are my rex's to collect the date/time fields - please be gentle, this is my first effort at regex & rex in Splunk.

To Collect the start -
| rex field=_raw "(?(...([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})))" max_match=0

To Collect the end - this is the one that isn't working because it gets the last digit from the start time.

| rex field=_raw "(?([0-9]..([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})))" max_match=0

Please let me know if anything needs more explanation. Thanks

0 Karma
1 Solution

niketn
Legend

@timrich66, you can write a single rex to extract all the fields you are interested in. Following is a run anywhere search example based on the same data provided above. Instead of the makeresults and eval commands you would need to use your base search to test with the actual data.

| makeresults
| eval _raw="job#1 2018/03/02 23:00:00 2018/03/02 23:01:00 SU
job#2 2018/03/02 23:01:01 2018/03/02 23:01:50 SU
job#3 2018/03/02 23:02:01 2018/03/02 23:03:50 FA"
| rex "job#(?<job_num>[^\s]+)\s(?<start_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<end_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<status>\w+)" max_match=0

PS: For testing and picking up on regular expressions you should check out regex101.com

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@timrich66, you can write a single rex to extract all the fields you are interested in. Following is a run anywhere search example based on the same data provided above. Instead of the makeresults and eval commands you would need to use your base search to test with the actual data.

| makeresults
| eval _raw="job#1 2018/03/02 23:00:00 2018/03/02 23:01:00 SU
job#2 2018/03/02 23:01:01 2018/03/02 23:01:50 SU
job#3 2018/03/02 23:02:01 2018/03/02 23:03:50 FA"
| rex "job#(?<job_num>[^\s]+)\s(?<start_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<end_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<status>\w+)" max_match=0

PS: For testing and picking up on regular expressions you should check out regex101.com

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

timrich66
Communicator

Thanks,@niketnilay, I've got that working now.

0 Karma

niketn
Legend

@timrich66, glad you got it working. Please accept the answer to mark this question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...