One way is to use rex. Assuming field named time:
my search | rex field=time "(?P<time>\d+/\d+[^/]+)"
One way is to use rex. Assuming field named time:
my search | rex field=time "(?P<time>\d+/\d+[^/]+)"