OK, thank you both! A different set of eyes with a different set of experience and knowledge behind them helped immensely! While neither answer was the one I needed, they both helped to give me new things to think through. More searching then found the key, which was found here:
http://splunk-base.splunk.com/answers/3651/calculate-diff-between-two-entries-in-a-transaction
mvindex can do what I need once I've made the transaction. Right now, again awfully messy and in need of much cleanup, is the complete code.
host=VNX | rex "Uptime: (?P \d+\s)" | rex "days, (?P \d+:\d+:\d+.\d+)" | rex "FAR_(?P [^_]+)"
| eval rt2=trim(rd).":".rt |eval realtime=strptime(rt2, "%j:%H:%M:%S.%N")
| transaction repl_name startswith="starting Incremental copy" endswith="completing Incremental copy"
| eval begintime=mvindex(realtime,0) | eval endtime=mvindex(realtime,1) |eval realduration=endtime-begintime
| fields duration,repl_name,realtime,begintime,endtime,realduration
So, in a rather convoluted form, I pull out the fields I need with the regular expressions (oh, I added back in the hundredths of a second), eval them into something unified so they can be converted to something that Splunk's math works on well.
Then create transactions out of those. Using mvindex, set a begintime and endtime via the different indexes into the transaction, then do a simple subtraction...
I now have
duration=1 <-- Notice these aren't right.
realduration=0.120000 <-- but LOOK!
begintime=1369133669.370000
endtime=1369133669.490000
realtime=1369133669.370000
realtime=1369133669.490000
repl_name=Source Mirror DS07
and
duration=0 <-- again, I won't belabor the obvious
realduration=0.140000 <-- Wonderful.
begintime=1369133428.730000
endtime=1369133428.870000
realtime=1369133428.730000
realtime=1369133428.870000
repl_name=Source Mirror DS07
And bonus - the solution won't be bothered by reboots of the storage processors, because they're only used in calculating the difference. (Or, will be as I clean things up).
... View more