Splunk Search

Regex for getting slow query logs from mongodb

rahuljayz
New Member

I am new to SPL. I want to get all mongo queries from my mongo logs which take more than 5 ms to execute. My mongo logs are like this:

Thu Jun 13 15:47:25 [conn15] update mydb.mycollection query: { cId: 2441, tId: 545, uId: 478, status: 1, type: "0",   dDt: { $lte: new Date(1371138445623) } } update: { $set: { status: 3 } } nscanned:120 nupdated:0 keyUpdates:0 locks(micros) w:10602 10ms

The last entry here (10 ms) is the time in milliseconds. How can I filter these queries?

Tags (3)
0 Karma
1 Solution

JSapienza
Contributor

Something like this should work for you :

...|rex field=_raw"(?<LastEntryTime>\d*)ms$" |search LastEntryTime>5

View solution in original post

Rob
Splunk Employee
Splunk Employee

JSapienza provided a nice working regex below. I would recommend checking if Splunk will automatically extract that as well. You might already have this in field.

JSapienza
Contributor

Something like this should work for you :

...|rex field=_raw"(?<LastEntryTime>\d*)ms$" |search LastEntryTime>5
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...