Splunk Search

Conversion of epoch time in rex extracted field

adalbor
Builder

Hey All,

Need some assistance with extracting/converting the epoch timestamps on index buckets from a search that I created.

This is what I have so far:

index=_internal sourcetype=splunkd log_level=INFO component=BucketMover "freeze succeeded"
| rex field=event_message "AsyncFreezer\s+(?\w+\s\w+).*lib/splunk/(?\w+)/\w+/(?.*)'"
| search NOT Index=_internaldb AND NOT Index=_introspection
| table _time host Action Index Bucket_Filename
| sort Index

I would like to extract the bucket beginning and ending timestamps and convert them into a human readable format so I can use those also.

Any assistance would be greatly appreciated!

Raw sample:
12-09-2019 10:54:56.422 -0600 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'

event_message sample:
AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'

0 Karma
1 Solution

oscar84x
Contributor

You could try extracting the two values separately and converting them like this:

|  makeresults
| eval data="AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1;;;
12-09-2019 10:54:56.422 -0600 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'"
| makemv delim=";;;" data
| mvexpand  data
|  rex field=data "rb\_(?<latest_epoch>\d+)\_(?<earliest_epoch>\d+)\_"
| eval latestEventInBucket=strftime(latest_epoch,"%m/%d/%y %H:%M:%S")
| eval earliestEventInBucket=strftime(earliest_epoch,"%m/%d/%y %H:%M:%S")

View solution in original post

0 Karma

oscar84x
Contributor

You could try extracting the two values separately and converting them like this:

|  makeresults
| eval data="AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1;;;
12-09-2019 10:54:56.422 -0600 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'"
| makemv delim=";;;" data
| mvexpand  data
|  rex field=data "rb\_(?<latest_epoch>\d+)\_(?<earliest_epoch>\d+)\_"
| eval latestEventInBucket=strftime(latest_epoch,"%m/%d/%y %H:%M:%S")
| eval earliestEventInBucket=strftime(earliest_epoch,"%m/%d/%y %H:%M:%S")
0 Karma

adalbor
Builder

The raw sample and the event_message sample don't need to be combined. I was just posting a raw and an extracted sample if it would help with writing something.

0 Karma

oscar84x
Contributor

Yes. I did it that just to test it. I guess I didn't have to include everything, but the part that's relevant to your question is everything from the rex command and under. The regex in the rex command should find the format for the bucket naming convention regardless of the event's pattern.

0 Karma

adalbor
Builder

My hero!
That helped me a ton!

This is what I ended up with to get what I needed in the end:

index=_internal sourcetype=splunkd log_level=INFO component=BucketMover "freeze succeeded"
| rex field=event_message "AsyncFreezer\s+(?\w+\s\w+).*lib/splunk/(?\w+)/\w+/(?.*)'"
| search NOT Index=_internaldb AND NOT Index=_introspection
| rex field=Bucket_Filename "\Sb\_(?\d+)\_(?\d+)\_"
| eval latestEventInBucket=strftime(latest_epoch,"%m/%d/%y %H:%M:%S")
| eval earliestEventInBucket=strftime(earliest_epoch,"%m/%d/%y %H:%M:%S")
| table _time earliestEventInBucket latestEventInBucket host Action Index Bucket_Filename
| sort Index

oscar84x
Contributor

Glad to help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...