I wanted to extract the below values.
Sample data:
Time Taken: 937534 URL_STRING: /account/signin.jsp 95.104.163.4 - - [27/Jul/2015:02:10:34 -0700] "GET /account/signin.jsp?PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374304776473&bmUID=kX4Nj97 HTTP/1.1" 200 Bytes: 97413 "http://www.xxx.com/shop/dept_category.jsp?productSizeSelected=0&pageClicked=0&PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374306291898&bmUID=kX4NaK4" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 YaBrowser/15.6.2311.5029 Safari/537.36"
See if this works (run anywhere sample based on your data)
| gentimes start=-1 | eval temp="Time Taken: 937534 URL_STRING: /account/signin.jsp 95.104.163.4 - - [27/Jul/2015:02:10:34 -0700] \"GET /account/signin.jsp?PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374304776473&bmUID=kX4Nj97 HTTP/1.1\" 200 Bytes: 97413 \"http://www.xxx.com/shop/dept_category.jsp?productSizeSelected=0&pageClicked=0&PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374306291898&bmUID=kX4NaK4\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 YaBrowser/15.6.2311.5029 Safari/537.36\"" | table temp | rename temp as _raw | rex "Time Taken: (?<TimeTaken>\d+)([^\"]+)\"([^\"]+)\" (?<ResponseCode>\d+)"
Hi,
timetaken------- rex "Time Taken:(?\d*)"
status---------- rex "HTTP/\d.\d\"(?\d*)"
you can try with erex command and can get the proper regular expression from job or you can use the knowlede object "field extraction" so that you can get the base regular expression.
Above regular expression required little bit tweaking and testing.
-Krishan Rajapantula.