Splunk Search

How to get max value of string inside braces

jsamadhan
New Member

Hi All,

I am new to splunk and need help in creating a table to get max value.
Below are my sample logs -

2017-05-25 14:21:06,757 INFO [http-/x.x.x.x.x:] [blablaServiceImpl] [myservices()][blablablablabla] [blablablablabla] [TOTAL_TIME_TAKEN][181]

Kindly help getting a table where max value of TOTAL_TIME_TAKEN will be displayed in (tabular foramat) per service

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
|  rex "^([^\]]+\]){2}\s*\[(?<service>.*?)\(\)\]([^\]]+\]){2}\s*\[TOTAL_TIME_TAKEN\]\s*\[(?<TOTAL_TIME_TAKEN>\d+)"
| stats max(TOTAL_TIME_TAKEN) BY service

adonio
Ultra Champion

if you have lets say 181 extracted as a value of TOTAL_TIME_TAKEN

... | stats max(TOTAL_TIME_TAKEN) by service ?
0 Karma

adonio
Ultra Champion

or... full solution by @woodcock

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...