Timestamp regex not capturing correctly.

[dmalina_splunk]

Hello,

Is it possible to write a regex that has two different capture areas for the timestamp?

Here is my problem:

<date_of_stop>2016-07-31T00:00:00</date_of_stop>
<time_of_stop>10:19:00</time_of_stop>

I need to capture 2016-07-31 as the date and 10:19:00 as the time. Any help with this regex will be much appreciated!

Thank you!

[sundareshr]

Like this

... | rex "date_of_stop\>(?<date>\d{4}-\d{2}-\d{2})" | rex "time_of_stop\>(?<time>\d{2}:\d{2}:\d{2})"

[dmalina_splunk]

It's not accepting it. Any idea why?

Here's my props.conf:

[montgomery]
KV_MODE = xml
SHOULD_LINEMERGE = false
TRUNCATE = 0
FIELD_HEADER_REGEX = <row>
TIME_FORMAT = ... | rex "date_of_stop\>(?<date>\d{4}-\d{2}-\d{2})" | rex "time_of_stop\>(?<t$
TZ = America/New_York
NO_BINARY_CHECK = true
category = Structured
description = xml
disabled = false
pulldown_type = true

The data looks like this:

<response>
<row>
<row _id="1997904" _uuid="5AC96B41-45F6-465B-B041-627CC0C5F85E" _position="1997904" _address="http://data.montgomerycountymd.gov/resource/_7v7q-yqtw/1997904">
<date_of_stop>2016-07-31T00:00:00</date_of_stop>
<time_of_stop>10:19:00</time_of_stop>
<agency>MCP</agency>
<subagency>4th district, Wheaton</subagency>
<description>GLASS (*)</description>
<location>UNIVERSITY BLVD W. AT ARCOLA AVE.</location>
<latitude>-77.02636</latitude>
<longitude>39.0358783333333</longitude>
<accident>No</accident>
<belts>No</belts>
<personal_injury>No</personal_injury>
<property_damage>No</property_damage>
<fatal>No</fatal>
<commercial_license>No</commercial_license>
<hazmat>No</hazmat>
<commercial_vehicle>No</commercial_vehicle>
<alcohol>No</alcohol>
<work_zone>No</work_zone>
<state>MD</state>
<vehicle_type>02 - Automobile</vehicle_type>
<year>1998</year>
<make>TOYT</make>
<model>4S</model>
<color>RED</color>
<violation_type>ESERO</violation_type>
<charge>61*</charge>
<contributed_to_accident>No</contributed_to_accident>
<race>HISPANIC</race>
<gender>F</gender>
<driver_city>SILVER SPRING</driver_city>
<driver_state>MD</driver_state>
<dl_state>MD</dl_state>
<arrest_type>A - Marked Patrol</arrest_type>
<geolocation human_address="{"address":"","city":"","state":"","zip":""}" latitude="-77.02636" longitude="39.0358783333333" needs_recoding="false"/>
</row>
<row _id="1997903" _uuid="0A9C6B92-26DE-4CE3-81ED-440C7D6EACF3" _position="1997903" _address="http://data.montgomerycountymd.gov/resource/_7v7q-yqtw/1997903">
<date_of_stop>2016-07-31T00:00:00</date_of_stop>
<time_of_stop>10:19:00</time_of_stop>
<agency>MCP</agency>
<subagency>4th district, Wheaton</subagency>
<description>STOP LIGHTS (*)</description>
<location>UNIVERSITY BLVD W. AT ARCOLA AVE.</location>
<latitude>-77.02636</latitude>
<longitude>39.0358783333333</longitude>
<accident>No</accident>
<belts>No</belts>
<personal_injury>No</personal_injury>
<property_damage>No</property_damage>
<fatal>No</fatal>
<commercial_license>No</commercial_license>
<hazmat>No</hazmat>
<commercial_vehicle>No</commercial_vehicle>
<alcohol>No</alcohol>
<work_zone>No</work_zone>
<state>MD</state>
<vehicle_type>02 - Automobile</vehicle_type>
<year>1998</year>
<make>TOYT</make>
<model>4S</model>
<color>RED</color>
<violation_type>ESERO</violation_type>
<charge>64*</charge>
<contributed_to_accident>No</contributed_to_accident>
<race>HISPANIC</race>
<gender>F</gender>
<driver_city>SILVER SPRING</driver_city>
<driver_state>MD</driver_state>
<dl_state>MD</dl_state>
<arrest_type>A - Marked Patrol</arrest_type>
<geolocation human_address="{"address":"","city":"","state":"","zip":""}" latitude="-77.02636" longitude="39.0358783333333" needs_recoding="false"/>
</row>
</row>
</response>

[sundareshr]

Unfortunately, you cannot extract timestamp from different places in the log file. Your only option will be to extract the time and append the time as a calculated field and use that for time based searches. Not the most efficient, I know.