How to write regex to extract to extract time stamps (I don't want to use _time) from events for a transaction search?

[hemanath_ofc]

10/21/14 13:17:07.747 Terminal.Send Start
10/21/14 13:17:07.747 Serial Port cleared OK
10/21/14 13:17:07.809 GetAckNak Sent: [06]
10/21/14 13:17:07.840 GET_TenderTypeStatus = 0
10/21/14 13:17:07.919 Serial Port cleared OK
10/21/14 13:17:07.919 Send Msg(8) >[02]XPI[1C]1[03]o<
10/21/14 13:17:07.981 GetAckNak Recv: [06]
10/21/14 13:17:08.090 GET_TenderTypeStatus = 0
10/21/14 13:17:08.090 Serial Port cleared OK
10/21/14 13:17:08.153 SERIAL Recv: [06]
10/21/14 13:17:08.262 Serial Port cleared OK
10/21/14 13:17:08.747 Terminal.Send Start
.....
.....
10/21/14 13:17:08.747 Terminal.Send Start
10/21/14 13:17:08.747 Serial Port cleared OK
10/21/14 13:17:08.809 GetAckNak Sent: [06]
10/21/14 13:17:08.840 GET_TenderTypeStatus = 0
10/21/14 13:17:08.919 Serial Port cleared OK
10/21/14 13:17:08.919 Send Msg(8) >[02]XPI[1C]1[03]o<
10/21/14 13:17:08.981 GetAckNak Recv: [06]
10/21/14 13:17:09.090 GET_TenderTypeStatus = 0
10/21/14 13:17:09.090 Serial Port cleared OK
10/21/14 13:17:09.153 SERIAL Recv: [06]
10/21/14 13:17:09.262 Serial Port cleared OK
10/21/14 13:17:08.747 Terminal.Send Start

from the above log, i need to group a transaction based on Terminal.Send Start and end and display its start and end time and duration

i know i should use transaction startswith="Terminal.Send Start" endswith="Terminal.Send Start" |

also i need to get a start and end time for another event within the same transaction. i.e

for 10/21/14 13:17:08.809 GetAckNak Sent: [06]
10/21/14 13:17:08.981 GetAckNak Recv: [06]

Can I extract the time stamp using Regex? If yes, what is the regular expression i need use? Please help

[MuS]

Hi hermanath_ofc,

try something like this after the transaction:

... | rex "\s(?<myStart>(\d+[:\.]){3}\d+)\sGetAckNak\sSent" | rex "\s(?<myStop>(\d+[:\.]){3}\d+)\sGetAckNak\sRecv" | ...

to get the times for the needed events.

hope this helps ...

cheers, MuS