My raw event is:
07 Nov 2019 01:24:49 | INFO | DispatchThread: 6119 | *** Time taken to process 100 records 1009ms | GNS-C6CAE58A-3482-451B-A7B2-6F63DE58E4B3-002 | com.dhl.ms.sdm.jms.listeners.GNSMessageListener | onMessage |
i tried to get the number of records over time
| rex "Time taken to process(?[^\_]+)records(?[^ms]+)"
| eval aveDuration =recDuration/recNum
| table recNum recDuration aveDuration _raw
but, this is not returning the aveDuration even if i use the simple eval =recDuration/recNum
my rex is correct, and i even put in convert to num but, still not working.
HELP.
thanks
try this :
| rex "Time taken to process\s+(?<recNum>\d+)\s+records\s+(?<recDuration>\d+)"
| eval aveDuration=recDuration/recNum
| table recNum recDuration aveDuration _raw
Try this:
... | rex "Time taken to process(?[<recNum>\d+)\s*records\s*(?<recDuration>\d+)"
| eval aveDuration = recDuration / recNum
| table recNum recDuration aveDuration _raw
try this :
| rex "Time taken to process\s+(?<recNum>\d+)\s+records\s+(?<recDuration>\d+)"
| eval aveDuration=recDuration/recNum
| table recNum recDuration aveDuration _raw
Thanks! this helps!
this is now working. will take note on the whitespace for my rex moving forward.
I don't think the regex is correct, it looks like it might be capturing leading whitespace, try Time\s+taken\s+to\s+process\s+(?<recNum>\d+)\s+records\s+(?<recDuration>\d+)ms
and see if it helps.
Also, this might be overkill, but I like to be explicit in my SPL so I would do the following in the eval | eval aveDuration=('recDuration'/'recNum')