I do not think you need to worry about specifying the time format for the type of event you've provided. By default Splunk will look through the message and recognize the date and time and will adopt the first instance in the message as the event timestamp.
In the example below, you can appreciate how this behaves, regardless of the format of the event.
Since your objective is to capture the first and second time definitions as fields, independently of the event timestamp, then a field extraction is necessary.
sourcetype="answers-1372987051" | rex "(?<First_Time>\d{14})\d{3}[a-zA-Z\s]+\_[A-Z]{1}(?<Second_Time>.{14})\d{3}[a-zA-Z\s]+\_[A-Z]{1}?$"
(?<First_Time>\d{14})Capture the
first 14 digits and assign capture to
"First_Time"\d{3}Account for the milliseconds
digits[a-zA-Z\s]+A bunch of words,
possibly separated with a space.\_[A-Z]{1}ends with and underscore
and a single capital letter (I don't know that you need to escape the underscore but ... whatever)
... repeat the same pattern above for the second field in a consecutive fashion.
Of course now you can automate the extraction by copying to your props.conf:
#props.conf
[answers-1372987051]
EXTRACT-my_fields = (?<First_Time>\d{14})\d{3}[a-zA-Z\s]+\_[A-Z]{1}(?<Second_Time>.{14})\d{3}[a-zA-Z\s]+\_[A-Z]{1}?$
It may be possible that the data sample does not match real-life data exactly. In which case you may need to readjust the regular expression to match the actual pattern in your events.
If it helps, you can also match the fields with simpler regular expressions.
#props.conf
[answers-1372987051]
EXTRACT-my_alt_field_1 = (?<alt_first_time>\d{14})\d{3}
EXTRACT-my_alt_field_2 = _[A-Z]{1}(?<alt_second_time>\d{14})\d{3}
Which will give you similar results as the other procedure.
At this point you can use the search function along with your fields.
sourcetype="answers-1372987051" First_Time="20130624090015*"
I do not think you need to worry about specifying the time format for the type of event you've provided. By default Splunk will look through the message and recognize the date and time and will adopt the first instance in the message as the event timestamp.
In the example below, you can appreciate how this behaves, regardless of the format of the event.
Since your objective is to capture the first and second time definitions as fields, independently of the event timestamp, then a field extraction is necessary.
sourcetype="answers-1372987051" | rex "(?<First_Time>\d{14})\d{3}[a-zA-Z\s]+\_[A-Z]{1}(?<Second_Time>.{14})\d{3}[a-zA-Z\s]+\_[A-Z]{1}?$"
(?<First_Time>\d{14})Capture the
first 14 digits and assign capture to
"First_Time"\d{3}Account for the milliseconds
digits[a-zA-Z\s]+A bunch of words,
possibly separated with a space.\_[A-Z]{1}ends with and underscore
and a single capital letter (I don't know that you need to escape the underscore but ... whatever)
... repeat the same pattern above for the second field in a consecutive fashion.
Of course now you can automate the extraction by copying to your props.conf:
#props.conf
[answers-1372987051]
EXTRACT-my_fields = (?<First_Time>\d{14})\d{3}[a-zA-Z\s]+\_[A-Z]{1}(?<Second_Time>.{14})\d{3}[a-zA-Z\s]+\_[A-Z]{1}?$
It may be possible that the data sample does not match real-life data exactly. In which case you may need to readjust the regular expression to match the actual pattern in your events.
If it helps, you can also match the fields with simpler regular expressions.
#props.conf
[answers-1372987051]
EXTRACT-my_alt_field_1 = (?<alt_first_time>\d{14})\d{3}
EXTRACT-my_alt_field_2 = _[A-Z]{1}(?<alt_second_time>\d{14})\d{3}
Which will give you similar results as the other procedure.
At this point you can use the search function along with your fields.
sourcetype="answers-1372987051" First_Time="20130624090015*"
