Why re-invent the wheel? Unless you are opposed to wasting man-hours, use a Splunk® search or query that is either exactly what you want or close enough you can modify to do just what you need.