topic Re: How to extract fields with a value greater than 3 seconds? in Splunk Search

How to extract fields with a value greater than 3 seconds?

sp_lunky — Wed, 08 Feb 2017 16:57:17 GMT

First sorry for my english. I'm testing Splunk at the moment, and i have a task to extract a field from *.log files.

Raw value is :

..xxxxxxxxxxxxxxx Duration: 1 s. 466 ms....
..xxxxxxxxxxxxxxx Duration: 4 s. 066 ms...
..xxxxxxxxxxxxxxx Duration: 12 s. 300 ms...

I want to to make an alert when the Duration is greater than 3 s

for a Report I filtered with search command, but it won't show the value like: "11", "12"

host=NAME | search (duration:"4" OR "5" OR "6" OR "7" OR "8" OR "9" )

Any help please!?

Re: How to extract fields with a value greater than 3 seconds?

vasanthmss — Wed, 08 Feb 2017 17:31:37 GMT

try this,

your base search | rex "Duration:\s+(?<duration>\d+)" | where duration>3

Hope this will help you.

Re: How to extract fields with a value greater than 3 seconds?

paulstout — Wed, 08 Feb 2017 17:32:57 GMT

Could you try this search?

host=name | rex field=_raw "Duration\:\s(?<duration_s>\d+)\ss\.\s+(?<duration_ms>\d+)\sms" | eval duration=duration_s+(duration_ms/1000) | search duration_s="*"?

This would give you a float with the actual duration in duration and separate fields for the second and millisecond component to use your original filtering.

Re: How to extract fields with a value greater than 3 seconds?

somesoni2 — Wed, 08 Feb 2017 17:35:09 GMT

The threshold sp_lunky looking for is 3 sec. You may want to correct it.

Re: How to extract fields with a value greater than 3 seconds?

paulstout — Wed, 08 Feb 2017 17:39:21 GMT

To meet the original 3 second requirement, | where duration_s>3 or | search duration_s>3 should suffice.

Re: How to extract fields with a value greater than 3 seconds?

vasanthmss — Wed, 08 Feb 2017 17:54:34 GMT

updated the answer.

Re: How to extract fields with a value greater than 3 seconds?

sp_lunky — Thu, 09 Feb 2017 12:00:42 GMT

Thank you very much! Both are good and working. But I accepted paulstout answer because it satisfy both my needs.
Thank you again!

Re: How to extract fields with a value greater than 3 seconds?

DalJeanis — Thu, 09 Feb 2017 17:15:39 GMT

I believe you can accept more than one answer, if they both helped.

Re: How to extract fields with a value greater than 3 seconds?

sp_lunky — Fri, 10 Feb 2017 14:50:54 GMT

Sorry, i didn't now that