Fetch start_time and end_time_new from Log content

[Gopi-10]

LOG Content: 
25/08/13 11:23:51 INFO log_msg for Job status in nprod: Appended latest task for job_id 1234: {'job_id': '1234', 'run_id': '321', 'task_key': 'GRR', 'start_time_new': 'Aug 13, 2025, 10:00 AM', 'end_time_new': 'Aug 13, 2025, 10:00 AM', 'result_state': 'FAILED', 'execution_duration': '0m 3s'}

Used below query by got NULL result:

fetch logs //, scanLimit: 500, samplingRatio: 1000
| filter matchesPhrase(content, "1234")
| filter matchesValue(loglevel, "INFO")
| parse content, " 'start_time_new': '<start>'"
| sort timestamp desc
| fields start

[Akhil-Jayendran · Accepted solution]

Hello @Gopi-10 ,

Can you try this?

| parse content, """LD 'start_time_new\': \'' LD:start_time_new '\','"""