topic How to parse p4 logs in Splunk Search

How to parse p4 logs

vinodarokiya — Thu, 12 Nov 2020 13:19:24 GMT

2020/11/12 12:37:17 pid 282689 compute end .028s 23+5us 0+32io 0+0net 16472k 0pf Perforce server info: Server network estimates: files added/updated/deleted=0/0/0, bytes added/updated=0/0

2020/11/12 08:53:57 pid 249917 xyz@admin-client-for-stag 127.0.0.1 [p4/2018.1/LINUX26X86_64/1738923] 'user-sizes //ddc/...' --- lapse 98.5s --- rpc msgs/size in+out 0+1814189/0mb+509mb himarks 795800/318788 snd/rcv 92.8s/.000s --- db.revhx --- locks read/write 1/0 rows get+pos+scan put+del 0+1+1814190 0+0

2020/11/12 08:21:39 pid 245315 xyz@Admin-client-for-stag 127.0.0.1 [p4/2018.1/LINUX26X86_64/1738923] 'user-sizes -s -a -b 512 //mapgrp/...' --- lapse 106s --- usage 51584+13969us 75284368+0io 0+0net 8832k 0pf --- db.rev --- pages in+out+cached 4704508+0+96

2020/11/12 08:14:10 pid 243592 yyyz@admin-client-for-stag 127.0.0.1 [p4/2018.1/LINUX26X86_64/1738923] 'user-sizes -s -a -b 512 //projects/...' --- lapse 80.4s --- usage 38774+9874us 49562128+0io 0+0net 8832k 0pf --- db.rev --- pages in+out+cached 3374543+0+96

I have logs which shows lapse in seconds , they are several other logs along with this , i want to extract if logs pattern contains lapse and if lapse is greater than 100s ,and then print "xyz@admin-client-for-stag-21" who is the user who did this change ,may be extract only

xyz

user

Any help ?

Thanks,

Re: How to parse p4 logs

richgalloway — Thu, 12 Nov 2020 13:45:08 GMT

See if this helps.

... | rex "pid \d+ (?<user>\S+@\S+)" | rex "lapse (?<lapse>\d+\.?\d+)" | where lapse > 100 | table user lapse

Re: How to parse p4 logs

vinodarokiya — Thu, 12 Nov 2020 14:28:03 GMT

Thanks a lot

Re: How to parse p4 logs

vinodarokiya — Fri, 13 Nov 2020 08:10:37 GMT

May I please know how to extract one more table with all data that s there inside single quotes like :

'user-sizes //ddc/...'

After getting username , lapse ,how do we even print data that s within single quotes @richgalloway

Re: How to parse p4 logs

richgalloway — Fri, 13 Nov 2020 14:13:43 GMT

The process is very similar

... | rex "'(?<field1>[^\/]+)\/(?<field2>[^\/]*)\/(?<field3>[^\/]+)\/(?<field4>[^']+)'" ...

Re: How to parse p4 logs

vinodarokiya — Thu, 19 Nov 2020 08:37:01 GMT

Thank you!