topic How to edit a rex search in order to find the average duration time between two fields? in Getting Data In

How to edit a rex search in order to find the average duration time between two fields?

anthonycopus — Thu, 08 Dec 2016 19:00:35 GMT

Hi,

I'm currently have issues parsing the duration I've created to find the average time between 2 fields based on a set of logs.
In short, the field I'm trying to parse is in this format:

35+00:06:47.000000

And I'm using this rex:

| rex field=diff "(?<durationDays>\d+)+(?<durationHours>\d+):(?<durationMinutes>\d+):(?<durationSeconds>.*)"

However, the "durationDays" here is coming out completely wrong, and is actually an optional field since many of the logs will have less than 1 day. What's the best way to approach this?

Re: How to edit a rex search in order to find the average duration time between two fields?

bshuler_splunk — Thu, 08 Dec 2016 19:07:52 GMT

| makeresults | eval date="35+00:06:47.000000%35+00:06:47.000000%+00:06:47.000000%00:06:47.000000" | rex field=date max_match=0 "(?<date>[^%]+)" | mvexpand date | table date | rex field=date "(?<durationDays>\d+)?\+?(?<durationHours>\d{2}):(?<durationMinutes>\d{2}):(?<durationSeconds>\d{2}\.\d{6})"

Re: How to edit a rex search in order to find the average duration time between two fields?

anthonycopus — Thu, 08 Dec 2016 19:18:24 GMT

Perfect, thanks a lot!