Hi Team,
I have indexed system logs into the SPLUNK and it looks something like below:
[4/1/14 6:06:10:218 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.218 | | | | | | | Completed ftpHandler .doPost
[4/1/14 6:06:10:938 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.938 | | | | | | | In FTP recognize *****Reqtype:E****Filename:FDD_110001001_110001000_20140401_062210_20140401_3_201404010622421530_P.XCF
Now here, I want to retrieve the time when the "Completed ftpHandler .doPost" operation has been completed say 2014-04-01 06:06:10.218 as per our example above and the time when the "requesttype:E" operation has been completed say 2014-04-01 06:06:10.938 . Once I get these two time values then I should be able to calculate the difference between those two time period.
I need query to be written in such a manner. Is that possible?
Please help!
Regards,
Sushma.
Hi sushma7,
something like this will bring you ad-hoc results:
YourBaseSearchHere
| rex field="_raw" "(?=\s\|\s)(?<mydoPostTime>.+)(?<=\s(\|\s){7}Completed\sftpHandler\s\.doPost)"
| rex field="_raw" "(?=\s\|\s)(?<mydoReqtypeTime>.+)(?<=\s(\|\s){7}In\sFTP\srecognize\s\*\*\*\*\*Reqtype:E\*\*\*\*)"
| eval mydoPostTime_epoch=strptime(mydoPostTime,"%Y-%m-%d %H:%M:%S.%3Q")
| eval mydoReqtypeTime_epoch=strptime(mydoReqtypeTime,"%Y-%m-%d %H:%M:%S.%3Q")
| eval diff=mydoReqtypeTime_epoch-mydoPostTime_epoch
| eval run_time=strftime(diff, "%H:%M:%S.%3Q")
You should setup this as field extraction so you will no longer need the rex
commands.
hope this helps ...
cheers, MuS
Hi sushma7,
something like this will bring you ad-hoc results:
YourBaseSearchHere
| rex field="_raw" "(?=\s\|\s)(?<mydoPostTime>.+)(?<=\s(\|\s){7}Completed\sftpHandler\s\.doPost)"
| rex field="_raw" "(?=\s\|\s)(?<mydoReqtypeTime>.+)(?<=\s(\|\s){7}In\sFTP\srecognize\s\*\*\*\*\*Reqtype:E\*\*\*\*)"
| eval mydoPostTime_epoch=strptime(mydoPostTime,"%Y-%m-%d %H:%M:%S.%3Q")
| eval mydoReqtypeTime_epoch=strptime(mydoReqtypeTime,"%Y-%m-%d %H:%M:%S.%3Q")
| eval diff=mydoReqtypeTime_epoch-mydoPostTime_epoch
| eval run_time=strftime(diff, "%H:%M:%S.%3Q")
You should setup this as field extraction so you will no longer need the rex
commands.
hope this helps ...
cheers, MuS
follow the link to the docs and the commands look good, just cross-checked
How to use filed extraction rather than this rex commands?