Getting Data In

How to edit a rex search in order to find the average duration time between two fields?

anthonycopus
Path Finder

Hi,

I'm currently have issues parsing the duration I've created to find the average time between 2 fields based on a set of logs.
In short, the field I'm trying to parse is in this format:

35+00:06:47.000000

And I'm using this rex:

| rex field=diff "(?<durationDays>\d+)+(?<durationHours>\d+):(?<durationMinutes>\d+):(?<durationSeconds>.*)"

However, the "durationDays" here is coming out completely wrong, and is actually an optional field since many of the logs will have less than 1 day. What's the best way to approach this?

0 Karma
1 Solution

bshuler_splunk
Splunk Employee
Splunk Employee
| makeresults | eval date="35+00:06:47.000000%35+00:06:47.000000%+00:06:47.000000%00:06:47.000000" | rex field=date max_match=0 "(?<date>[^%]+)" | mvexpand date | table date | rex field=date "(?<durationDays>\d+)?\+?(?<durationHours>\d{2}):(?<durationMinutes>\d{2}):(?<durationSeconds>\d{2}\.\d{6})"

View solution in original post

0 Karma

bshuler_splunk
Splunk Employee
Splunk Employee
| makeresults | eval date="35+00:06:47.000000%35+00:06:47.000000%+00:06:47.000000%00:06:47.000000" | rex field=date max_match=0 "(?<date>[^%]+)" | mvexpand date | table date | rex field=date "(?<durationDays>\d+)?\+?(?<durationHours>\d{2}):(?<durationMinutes>\d{2}):(?<durationSeconds>\d{2}\.\d{6})"
0 Karma

anthonycopus
Path Finder

Perfect, thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...