Splunk Search

calculating time of free form value in log message

moj0002
New Member

Is there a way I can create a bar chart with the response time extracted from these free form log messages that corellate on the ID. There will always only be a pair (starting and finished) I would like the result to be timestamp and the duration (in this case)

2014.02.18-19:05:07:687 minus 2014.02.18-19:05:07:583 = 104 milliseconds displayed in a barchart.

Not sure if this is possible

19:05:07,583 INFO starting to wait for message with ID [ID:ABC2020123} at [2014.02.18-19:05:07:583]

19:05:10,216 INFO starting to wait for message with ID [ID:XYZ2020456} at [2014.02.18-19:05:10:216]

19:05:07,687 INFO finished waiting for message with ID [ID:ABC2020123} at [2014.02.18-19:05:07:687]

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

index=main sourcetype="mytran" | rex "^(?:[^ ]* ){2}(?P<action>[^ ]+)" | rex "\[ID:(?<ID>[^\}]+)" | transaction ID startswith=action=starting endswith=action=finished  | table _time, ID, duration

duration is in seconds.

0 Karma

HiroshiSatoh
Champion

I tried to extract the field(ID, time0).

・・・・・| rex field=_raw "[^\[\n]*\[\w+:(?P<ID>[^\}]+)[^\[\n]*\[(?P<time0>[^\]]+)" | transaction fields=ID|eval time1=strptime(mvindex(time0,0),"%Y.%m.%d-%H:%M:%S:%3N")|eval time2=strptime(mvindex(time0,1),"%Y.%m.%d-%H:%M:%S:%3N")|eval time3=time2-time1|table ID,time0,time1,time2,time3

alt text

0 Karma

moj0002
New Member

thank you that worked

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...