topic How to extract field as time in ms after occurrence of a string in Splunk Search

How to extract field as time in ms after occurrence of a string

ashvini_mishra — Wed, 22 Sep 2021 04:32:45 GMT

Here is a log example -

{"log_time":"2021-08-27T07:16:46.178275260+00:00","output":"stdout","log":"2021-08-27 07:16:46.178 [INFO ] [her-49] a.a.ActorSystemImpl - Logged Request:HttpMethod(POST):http://id-test.api-gateway.sit.ls.api.com/repos/hrn:idmrepo-sit::ol:idm_team_internal_test/ids/getOrCreate/bulk?streaming=true&dscid=GvaIrM-cb4005f6-a828-4fd7-9f54-6082e2912716:200 OK:4","k8scluster":"borg-dev-1-aws-west-1","namespace":"*","env":"DEV","app_time":"","time":"1630048606.178275260"}

I need to extract the digits after "OK:" (here highlighted in red color) as time in ms.
I am just started using splunk. I am trying this -

rex "([^\:]+$)(?P<duration>.+)" | stats exactperc98(duration) as P98 avg(duration) as AVG by log

But this is not working.

Re: How to extract field as time in ms after occurrence of a string

PickleRick — Wed, 22 Sep 2021 05:57:14 GMT

It's always best if you have the whole event parsed so you don't accidentaly hit some unexpected string occurrence in other part of the event. But anyway, it should be quite simple

| rex "OK:(?<duration>\d+)\"" | <<your stats>>

Re: How to extract field as time in ms after occurrence of a string

bowesmana — Wed, 22 Sep 2021 06:40:23 GMT

Given that you appear to have a field name 'log' already, which is the data from your JSON example, then if that's the field you need to extract duration from, then

| rex field=log "OK:(?<duration>\d+)"

Note that if the encapsulated log didn't result in a 200 OK response, then of course this will not work