All Apps and Add-ons

TESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTEST

jayaraj1717
New Member
0 Karma

TISKAR
Builder

Hello,

To extract field from _raw you can use extract field page:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/FXSelectFieldsstep

Or use the rex command:

| makeresults 
| eval _raw="DT=2018-04-13T00:14:19.480-0700 | AppId=R4 | Level=INFO |LogBody=[UID:***:20180413xxxxxx:, Message Timestamp:2018-04-13 00:14:19.329" 
| rex "DT=(?<DT>.*?) \|.* Timestamp:(?<Timestamp>.*)$"

If you have any question comment this post please

0 Karma

jayaraj1717
New Member

Thanks @vinod94 @richgalloway @kmaron. i am able to progress with this

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinod94
Contributor

You can try this,

| makeresults 
| eval _raw = "DT=2018-04-13T00:14:19.480-0700 | AppId=R4 | Level=INFO |LogBody=[UID:***:20180413xxxxxx:, Message Timestamp:2018-04-13 00:14:19.329" 
| rex field=_raw "DT\=(?P<DT>[^\s]*)" 
| rex field=_raw "Timestamp\:(?P<timestamp>.*)" 
| eval DT=strptime(DT, "%Y-%m-%dT%H:%M:%S.%3N%z") 
| eval timestamp=strptime(timestamp, "%Y-%m-%d %H:%M:%S.%3N") 
| eval diff=DT-timestamp 
| eval diff=tostring(diff, "duration") 

richgalloway
SplunkTrust
SplunkTrust

Timestamp strings need to be converted into epoch (integer) form to be compared or subtracted. Try this:

... | rex field=LogBody "Timestamp:(?<LBtime>.{23})" | eval DTepoch=strptime(DT, "%Y-%m-%dT%H:%M:%S.%3N%z"), LBepoch=strftime(LBtime,"%Y-%m-%d %H:%M:%S.%3N") | eval ResponseTime=DTepoch - LBepoch | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

kmaron
Motivator

I think this will get you close:

| makeresults 
| eval _raw = "DT=2018-04-13T00:14:19.480-0700 | AppId=R4 | Level=INFO |LogBody=[UID:***:20180413xxxxxx:, Message Timestamp:2018-04-13 00:14:19.329" 
| rex field=_raw "DT=(?<DT>.*?) \|" 
| rex field=_raw "Message Timestamp:(?<Timestamp>.*?)$"
| eval start= strptime(DT,"%Y-%m-%dT%H:%M:%S.%3N%z")
| eval end= strptime(Timestamp,"%Y-%m-%d %H:%M:%S.%3N")
| eval responsetime = start-end
| eval responsetime = strftime(responsetime, "%H:%M")

The two timestamps are pulled out with rex into fields DT and Timestamp.
The strptime converts them into UNIX time to subtract them and then strftime puts them back into hour:minute

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...