https://community.splunk.com/t5/Splunk-Search/Query-to-retrieve-the-data-from-the-logs/m-p/118611#M31684 <P>Hi Team,</P> <P>I have indexed system logs into the SPLUNK and it looks something like below:</P> <PRE><CODE>[4/1/14 6:06:10:218 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.218 | | | | | | | Completed ftpHandler .doPost [4/1/14 6:06:10:938 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.938 | | | | | | | In FTP recognize *****Reqtype:E****Filename:FDD_110001001_110001000_20140401_062210_20140401_3_201404010622421530_P.XCF </CODE></PRE> <P>Now here, I want to retrieve the time when the "Completed ftpHandler .doPost" operation has been completed say 2014-04-01 06:06:10.218 as per our example above and the time when the "requesttype:E" operation has been completed say 2014-04-01 06:06:10.938 . Once I get these two time values then I should be able to calculate the difference between those two time period.</P> <P>I need query to be written in such a manner. Is that possible?</P> <P>Please help!</P> <P>Regards,<BR /> Sushma.</P> Thu, 03 Apr 2014 09:14:19 GMT sushma7 2014-04-03T09:14:19Z https://community.splunk.com/t5/Splunk-Search/Query-to-retrieve-the-data-from-the-logs/m-p/118611#M31684 <P>Hi Team,</P> <P>I have indexed system logs into the SPLUNK and it looks something like below:</P> <PRE><CODE>[4/1/14 6:06:10:218 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.218 | | | | | | | Completed ftpHandler .doPost [4/1/14 6:06:10:938 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.938 | | | | | | | In FTP recognize *****Reqtype:E****Filename:FDD_110001001_110001000_20140401_062210_20140401_3_201404010622421530_P.XCF </CODE></PRE> <P>Now here, I want to retrieve the time when the "Completed ftpHandler .doPost" operation has been completed say 2014-04-01 06:06:10.218 as per our example above and the time when the "requesttype:E" operation has been completed say 2014-04-01 06:06:10.938 . Once I get these two time values then I should be able to calculate the difference between those two time period.</P> <P>I need query to be written in such a manner. Is that possible?</P> <P>Please help!</P> <P>Regards,<BR /> Sushma.</P> Thu, 03 Apr 2014 09:14:19 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-retrieve-the-data-from-the-logs/m-p/118611#M31684 sushma7 2014-04-03T09:14:19Z https://community.splunk.com/t5/Splunk-Search/Query-to-retrieve-the-data-from-the-logs/m-p/118612#M31685 <P>Hi sushma7,</P> <P>something like this will bring you ad-hoc results:</P> <PRE><CODE>YourBaseSearchHere | rex field="_raw" "(?=\s\|\s)(?&lt;mydoPostTime&gt;.+)(?&lt;=\s(\|\s){7}Completed\sftpHandler\s\.doPost)" | rex field="_raw" "(?=\s\|\s)(?&lt;mydoReqtypeTime&gt;.+)(?&lt;=\s(\|\s){7}In\sFTP\srecognize\s\*\*\*\*\*Reqtype:E\*\*\*\*)" | eval mydoPostTime_epoch=strptime(mydoPostTime,"%Y-%m-%d %H:%M:%S.%3Q") | eval mydoReqtypeTime_epoch=strptime(mydoReqtypeTime,"%Y-%m-%d %H:%M:%S.%3Q") | eval diff=mydoReqtypeTime_epoch-mydoPostTime_epoch | eval run_time=strftime(diff, "%H:%M:%S.%3Q") </CODE></PRE> <P>You should setup this as <A href="http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Addfieldsatsearchtime">field extraction</A> so you will no longer need the <CODE>rex</CODE> commands.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Thu, 03 Apr 2014 10:33:40 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-retrieve-the-data-from-the-logs/m-p/118612#M31685 MuS 2014-04-03T10:33:40Z https://community.splunk.com/t5/Splunk-Search/Query-to-retrieve-the-data-from-the-logs/m-p/118613#M31686 <P>How to use filed extraction rather than this rex commands?</P> Thu, 03 Apr 2014 10:38:17 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-retrieve-the-data-from-the-logs/m-p/118613#M31686 sushma7 2014-04-03T10:38:17Z https://community.splunk.com/t5/Splunk-Search/Query-to-retrieve-the-data-from-the-logs/m-p/118614#M31687 <P>follow the link to the docs and the commands look good, just cross-checked</P> Thu, 03 Apr 2014 10:41:09 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-retrieve-the-data-from-the-logs/m-p/118614#M31687 MuS 2014-04-03T10:41:09Z