Splunk Search

How to get max value of string inside braces

jsamadhan
New Member

Hi All,

I am new to splunk and need help in creating a table to get max value.
Below are my sample logs -

2017-05-25 14:21:06,757 INFO [http-/x.x.x.x.x:] [blablaServiceImpl] [myservices()][blablablablabla] [blablablablabla] [TOTAL_TIME_TAKEN][181]

Kindly help getting a table where max value of TOTAL_TIME_TAKEN will be displayed in (tabular foramat) per service

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
|  rex "^([^\]]+\]){2}\s*\[(?<service>.*?)\(\)\]([^\]]+\]){2}\s*\[TOTAL_TIME_TAKEN\]\s*\[(?<TOTAL_TIME_TAKEN>\d+)"
| stats max(TOTAL_TIME_TAKEN) BY service

adonio
Ultra Champion

if you have lets say 181 extracted as a value of TOTAL_TIME_TAKEN

... | stats max(TOTAL_TIME_TAKEN) by service ?
0 Karma

adonio
Ultra Champion

or... full solution by @woodcock

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...