Now working. One change in the log. Message for System message is: Rohi is online and Ready to chat. It its not ready to chat.
This is the one whcih I executed.
index="use_case_one"
| makemv tokenizer="(?ms)(.?)\s[\r\n]{2,}\s*" DATA
| rex field=DATA "(?\S+) is online and ready to chat."
| eval DATA=mvindex(DATA, mvfind(DATA, "online and ready to chat") + 1, -1)
| eval agentFilterRegEx = " [AP]M[\r\n\s]+" . agent . "[\r\n\s]"
| eval agentFirstResponse = mvindex(DATA, mvfind(DATA, agentFilterRegEx))
| rex field=agentFirstResponse "(?ms)^(?[^\r\n]+)[\r\n]+[^\r\n]+[\r\n]+(?.*)$"
| eval agentFirstResponseTime = strptime(agentFirstResponseTime, "%m/%d/%Y %H:%M:%S %p")
| fieldformat agentFirstResponseTime = strftime(agentFirstResponseTime, "%m/%d/%Y %H:%M:%S %p")
| table "Session Log" "DATA"
... View more