Splunk Search

How to select second date string from email?

timrich66
Communicator

Currently, our support team is sent an email that reports start and end times for jobs. It comes from an ancient system so the report cannot be updated. I need to extract jobname, start date/time, end date/time and status. I am having trouble extracting the second date/time. Can someone assist, please?

Here is an example of the email -

JOB RUN REPORT
Jobname Last Start Last End Status
job#1 2018/03/02 23:00:00 2018/03/02 23:01:00 SU
job#2 2018/03/02 23:01:01 2018/03/02 23:01:50 SU
job#3 2018/03/02 23:02:01 2018/03/02 23:03:50 FA
etc etc

These are my rex's to collect the date/time fields - please be gentle, this is my first effort at regex & rex in Splunk.

To Collect the start -
| rex field=_raw "(?(...([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})))" max_match=0

To Collect the end - this is the one that isn't working because it gets the last digit from the start time.

| rex field=_raw "(?([0-9]..([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})))" max_match=0

Please let me know if anything needs more explanation. Thanks

0 Karma
1 Solution

niketn
Legend

@timrich66, you can write a single rex to extract all the fields you are interested in. Following is a run anywhere search example based on the same data provided above. Instead of the makeresults and eval commands you would need to use your base search to test with the actual data.

| makeresults
| eval _raw="job#1 2018/03/02 23:00:00 2018/03/02 23:01:00 SU
job#2 2018/03/02 23:01:01 2018/03/02 23:01:50 SU
job#3 2018/03/02 23:02:01 2018/03/02 23:03:50 FA"
| rex "job#(?<job_num>[^\s]+)\s(?<start_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<end_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<status>\w+)" max_match=0

PS: For testing and picking up on regular expressions you should check out regex101.com

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@timrich66, you can write a single rex to extract all the fields you are interested in. Following is a run anywhere search example based on the same data provided above. Instead of the makeresults and eval commands you would need to use your base search to test with the actual data.

| makeresults
| eval _raw="job#1 2018/03/02 23:00:00 2018/03/02 23:01:00 SU
job#2 2018/03/02 23:01:01 2018/03/02 23:01:50 SU
job#3 2018/03/02 23:02:01 2018/03/02 23:03:50 FA"
| rex "job#(?<job_num>[^\s]+)\s(?<start_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<end_time>\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s(?<status>\w+)" max_match=0

PS: For testing and picking up on regular expressions you should check out regex101.com

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

timrich66
Communicator

Thanks,@niketnilay, I've got that working now.

0 Karma

niketn
Legend

@timrich66, glad you got it working. Please accept the answer to mark this question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...