topic Re: How can I change duration [5s] to something I can calculate with? in Splunk Search

How can I change duration [5s] to something I can calculate with?

svester — Tue, 15 Jan 2019 09:40:21 GMT

Hi, I made a search, and want to finetune it with something like "show duration >20seconds", but duration is showed as "duration [8s]". I tried extracting field and make "duration [8s]" a new extracted field, but I don't know how to calculate with these brackets, or how to define it.
Anyone who can help me out? Thanks!

Re: How can I change duration [5s] to something I can calculate with?

dkeck — Tue, 15 Jan 2019 10:05:06 GMT

Hi,

so your field value is now "duration [8s]"?

than use this regex: duration\s+\[(?<field>\d+)

This will only give you the numbers.

Re: How can I change duration [5s] to something I can calculate with?

svester — Tue, 15 Jan 2019 13:37:45 GMT

Thanks! It worked 🙂

Re: How can I change duration [5s] to something I can calculate with?

svester — Tue, 15 Jan 2019 13:56:11 GMT

One more problem I'm bumping in now.. what if I also get [..ms], so milliseconds... And I'm searching for, let's say duration>20, now I get results with >20 seconds AND >20 milliseconds. 2 regexes? Any other suggestions?

Re: How can I change duration [5s] to something I can calculate with?

dkeck — Tue, 15 Jan 2019 14:18:11 GMT

Please accept my answer if it worked 🙂 Thank you

Re: How can I change duration [5s] to something I can calculate with?

svester — Tue, 15 Jan 2019 14:20:51 GMT

Sorry, will do 🙂 Could you please check my 2nd comment? 🙂

Re: How can I change duration [5s] to something I can calculate with?

dkeck — Tue, 29 Sep 2020 22:42:47 GMT

you can do a new field yes.

You can change the name of the field to "field_a" duration\s+\[(?<field_a>\d+).

So just give it a name where you now its milliseconds.