topic Re: Regex in Dashboard is taking too much time in All Apps and Add-ons

Regex in Dashboard is taking too much time

nilaksh92 — Mon, 05 Jun 2017 14:28:42 GMT

Hi Everyone

I have multiple rex queries in my dashboard which are taking much time.

Is there any way, to take out the rex from my dashboard.

Query what I am using is

|rex field=a "(?<a_hour>[^:]+)?:(?<a_min>\d+)?:(?<a_sec>\d+)"
| eval a_seconds =(a_hour*3600)+(a_min * 60) + a_sec

Like this I have multiple queries for multiple fields.

Please help me out.

Thanks
Nikks

cmerriman — Mon, 05 Jun 2017 14:32:53 GMT

your field a is HH:MM:SS?
you could just do a |convert dur2sec(a) as a_seconds

nilaksh92 — Mon, 05 Jun 2017 14:43:23 GMT

it is in :MM:HH format.

I tried |convert dur2sec(a) as a_seconds but it didn't work with above format.

Is there any other way?

Thanks
Nikks

cmerriman — Mon, 05 Jun 2017 15:05:26 GMT

can you try to add timeformat=":%M:%H"

nilaksh92 — Mon, 05 Jun 2017 15:07:34 GMT

Can you tell me the way how to add this?

somesoni2 — Mon, 05 Jun 2017 15:12:51 GMT

Can we have some sample data please, for field a?

cmerriman — Mon, 05 Jun 2017 15:15:59 GMT

i agree, can we have a few samples of this? if you timestamp is in :MM:HH, the regex above doesn't seem likely to work properly.

nilaksh92 — Mon, 05 Jun 2017 15:17:46 GMT

it use to get data like
:00:00
12:34:78
:34:56

somesoni2 — Mon, 05 Jun 2017 15:23:04 GMT

Give this a try (adding HH portion if not present, then using convert)

....| eval a=if(len(a)!=8,"00".a,a)
| convert dur2sec(a) as a_seconds

nilaksh92 — Tue, 06 Jun 2017 07:59:45 GMT

Thanks somesoni.

It worked.

Can we create a calculated field for the

| eval a=if(len(a)!=8,"00".a,a)
 | convert dur2sec(a) as a_seconds

Thanks
Nikks