title: Regex to extract two values from single string in Splunk
body: <p>I've log statements appearing in Splunk as below.</p>
  
  <p><code>info Request method=POST, time=100, id=12345</code></p>
  
  <p><code>info Response statuscode=200, time=300, id=12345</code></p>
  
  <p>I'm trying to write a Splunk query that would extract the time parameter from the lines starting with info Request and info Response and basically find the time difference. Is there a way I can do this in a query? I'm able to extract values separately from each statement but not the two values together. </p>
  
  <p>I'm hoping for something like below, but I guess the piping won't work:</p>
  
  <p><code>... | search log="info Request*" | rex field=log "time=(?&lt;time1&gt;[^\,]+)" | search log="info Response*" | rex field=log "time=(?&lt;time2&gt;[^\,]+)" | table time1, time2</code></p>
  
  <p>Any help is highly appreciated.</p>