Splunk Search

regex help for timestamp extraction from event log

rakesh_498115
Motivator

Hi,

PFB My Sample log event .

Its has two timestamps in it , which are highlighted. i need to create two regexs to pick these values.

Sample log :

2013-07-02 12:39:39.991 ddl02773xx07 10.187.151.10 61011 20130702|http://www.bt.com/ccc/mdd/WA/|W28A|OrderDetails|Corsica|null|SA03|null|null|null|955|8006**|12:39:39... FASTPETE,UniqueID=0702106723570554,threadID=2ncr9uj5w0,busTxnSys=FASTPETE,busTxnHdr=PCK01069,busTxnType=FASTPETE,busProcOriginator=TAA

i.e first timestamp should come in field say startTime and second timestamp in field sat endTime

for the above log the values should be like this ,
startTime = 12:39:39:812
endTime = 12:39:39.991

can any one pls help in creating these two fields ??

I have used regex for startTime like this

rex "|(?\d{2}:\d{2}:\d{2}.\d{3})|" this is giving a field startTime . but unable to get the second timestamp as endTime.. any clue for getting second field ?

Tags (1)
0 Karma

linu1988
Champion

|rex "(?i)(?P\d+:\d+:\d+.\d+|\d+:\d+:\d+.\d+)|" |eval t=split(temp,"|")|eval starttime=mvindex(t,0)|eval endtime=mvindex(t,1)|table starttime,endtime. Another approach...

0 Karma

MuS
Legend

Hi rakesh_498115

I'm sure there is a better way, but as a quick shot I figured this out:

 (\|(\d{2}:\d{2}:\d{2}\.\d{3})){1}\|(?<myField>(\d{2}:\d{2}:\d{2}\.\d{3}))

cheers, MuS

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...