https://community.splunk.com/t5/Deployment-Architecture/How-to-extract-the-time-and-place-in-buckets/m-p/98188#M3634 <P>I don't know what you mean by "until breached" or "already breached." Exactly what are you comparing the nextBreachTime to?<BR /><BR /> However, this rex command will extract the field for you and translate it into epoch time, so that you can do time arithmetic.</P> <PRE><CODE>yoursearchhere | rex "\&lt;nextBreachTime\&gt;(?&lt;nextBreachTime&gt;\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2})\&lt;/nextBreachTime\&gt;" | eval nextBreachTime=strptime(nextBreachTime,"%m/%d/%Y %H:%M:%S") </CODE></PRE> <P>If you want to extract a large number of fields from xml-formatted input, take a look at the <A href="http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Xmlkv">xmlkv</A> command or the <A href="http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Spath">spath</A> command.</P> Tue, 23 Oct 2012 04:17:46 GMT lguinn2 2012-10-23T04:17:46Z https://community.splunk.com/t5/Deployment-Architecture/How-to-extract-the-time-and-place-in-buckets/m-p/98187#M3633 <P>Hello</P> <P>I am trying to calculate the data on the basis of "next.breachtime" field in data. I need to create 4 fields with fields which have already been breached,0-4 hours till breached,4-8 hours till breached,greater than 8 hours. I understand the concept of using eval statements and case statements to get it done. I am getting stuck in the concept of extracting the data from that field a computing it into the buckets. </P> <P>This is hoe that field will be in the data. </P> <PRE><CODE>&lt;nextBreachTime&gt;10/25/2012 13:17:52&lt;/nextBreachTime&gt; </CODE></PRE> <P>This is what I am trying to use. Can anyone please tell me on how do I extract that data and place it in the case statements. I am thinking of using rex statements, but I am kinda new to that so finding it a bit difficult to understand how to write rex statements</P> <PRE><CODE>eval mybucket=case(record.nextBreachTime=0,1,record.nextBreachTime&lt;4,2,record.nextBreachTime&lt;8,3,record.nextBreachTime&gt;8,4) </CODE></PRE> <P>Regards</P> <P>theou</P> Mon, 22 Oct 2012 15:36:06 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-extract-the-time-and-place-in-buckets/m-p/98187#M3633 theouhuios 2012-10-22T15:36:06Z https://community.splunk.com/t5/Deployment-Architecture/How-to-extract-the-time-and-place-in-buckets/m-p/98188#M3634 <P>I don't know what you mean by "until breached" or "already breached." Exactly what are you comparing the nextBreachTime to?<BR /><BR /> However, this rex command will extract the field for you and translate it into epoch time, so that you can do time arithmetic.</P> <PRE><CODE>yoursearchhere | rex "\&lt;nextBreachTime\&gt;(?&lt;nextBreachTime&gt;\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2})\&lt;/nextBreachTime\&gt;" | eval nextBreachTime=strptime(nextBreachTime,"%m/%d/%Y %H:%M:%S") </CODE></PRE> <P>If you want to extract a large number of fields from xml-formatted input, take a look at the <A href="http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Xmlkv">xmlkv</A> command or the <A href="http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Spath">spath</A> command.</P> Tue, 23 Oct 2012 04:17:46 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-extract-the-time-and-place-in-buckets/m-p/98188#M3634 lguinn2 2012-10-23T04:17:46Z