topic Re: How to extract time from the below message? in Splunk Search

How to extract time from the below message?

peterfox1992 — Wed, 23 Mar 2022 10:38:28 GMT

Hi Folks,

Can someone help me on the below. I have the below message in the log and need to extract the time portion alone.

[END~~Method.Search_Button] Response Time Search_Button: 00:00:00.3004626

The output I need is,

00:00:00.3004626

Also if possible, can suggest how I can get the value as millisecond? For the above message, I should get 300ms.

If the output is "00:00:01.250" then i should get as 1250ms.

Thanks.

Re: How to extract time from the below message?

gcusello — Wed, 23 Mar 2022 10:44:57 GMT

Hi @peterfox1992,

are you speaking of extract time as a field or as the event TimeStamp?

if as a field, you can use a regex like the following:

| rex "Search_Button:\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d\d\d\d"

if as timestamp, in sourcetype (props.conf) you have to define the following parameters:

[your_sourcetype] TIME_PREFIX = Search_Button:\s TIME_FORMAT = %H:%M:%S.%6N

Ciao.

Giuseppe

Re: How to extract time from the below message?

peterfox1992 — Wed, 23 Mar 2022 11:00:25 GMT

Thanks @gcusello . I have got the required result by using the rex command mentioned.

Now is there any possible to convert the time in millisecond?

If the output is "00:00:01.250" then i should get as 1250ms.

Re: How to extract time from the below message?

peterfox1992 — Wed, 23 Mar 2022 11:06:44 GMT

Thanks @gcusello . I have got the required result by using the rex command mentioned.

Now is there any possible to convert the time in millisecond?

If the output is "00:00:01.250" then i should get as 1250ms.

Re: How to extract time from the below message?

gcusello — Wed, 23 Mar 2022 11:13:21 GMT

Hi @peterfox1992,

after the rex command you have to use the eval command for the convertion:

| rex "Search_Button:\s+(?<hours>\d\d):/?<minutes>\d\d):(?<seconds>\d\d\)\.(?<milliseconds>\d\d\d\d\d\d)" | eval time_milliseconds=(hours*3600+minutes*60+seconds)*1000+milliseconds

Ciao.

Giuseppe

Re: How to extract time from the below message?

peterfox1992 — Wed, 23 Mar 2022 11:56:34 GMT

Thanks @gcusello . It worked 🙂

Cheers!