regex help for timestamp extraction from event log

[rakesh_498115]

Hi,

PFB My Sample log event .

Its has two timestamps in it , which are highlighted. i need to create two regexs to pick these values.

Sample log :

2013-07-02 12:39:39.991 ddl02773xx07 10.187.151.10 61011 20130702|http://www.bt.com/ccc/mdd/WA/|W28A|OrderDetails|Corsica|null|SA03|null|null|null|955|8006**|12:39:39... FASTPETE,UniqueID=0702106723570554,threadID=2ncr9uj5w0,busTxnSys=FASTPETE,busTxnHdr=PCK01069,busTxnType=FASTPETE,busProcOriginator=TAA

i.e first timestamp should come in field say startTime and second timestamp in field sat endTime

for the above log the values should be like this ,
startTime = 12:39:39:812
endTime = 12:39:39.991

can any one pls help in creating these two fields ??

I have used regex for startTime like this

rex "|(?\d{2}:\d{2}:\d{2}.\d{3})|" this is giving a field startTime . but unable to get the second timestamp as endTime.. any clue for getting second field ?

[linu1988]

|rex "(?i)(?P\d+:\d+:\d+.\d+|\d+:\d+:\d+.\d+)|" |eval t=split(temp,"|")|eval starttime=mvindex(t,0)|eval endtime=mvindex(t,1)|table starttime,endtime. Another approach...

[MuS]

Hi rakesh_498115

I'm sure there is a better way, but as a quick shot I figured this out:

 (\|(\d{2}:\d{2}:\d{2}\.\d{3})){1}\|(?<myField>(\d{2}:\d{2}:\d{2}\.\d{3}))

cheers, MuS