topic Re: How do I extract part of my sample log file? in Splunk Search

How do I extract part of my sample log file?

deenadp — Tue, 09 Feb 2016 22:26:32 GMT

Hi Team,

From the below portion of the log file, I want to display only the Elapsed Time: 01:05:22.0348974.
Can you pls help me with this?

-- 2/6/2016 11:02:42 AM
  Setup Completed
  Elapsed Time: 01:05:22.0348974
Setup Complete

Tried most of the suggested rex, but no luck:

| rex field=_raw "S(?<Elpased>\w*)"

Re: How do I extract part of my sample log file?

sk314 — Tue, 09 Feb 2016 23:57:54 GMT

Assuming the file is already indexed in Splunk, try this:

 | rex field=_raw "Elapsed Time:\s(?<elapsed_time>[^ \n\r]+)"

(Note: there's a space before \n\r)

Re: How do I extract part of my sample log file?

deenadp — Thu, 11 Feb 2016 20:39:51 GMT

Hi , I was able to fetch the Elapsed time as above but when I try the same for completion time, it doesn't display anything. pls advise If I need to change anything

Job Completed at 2/10/2016 12:10:26 PM
Elapsed Time:

00:09:43.7907662 Kernel mode CPU Time:
00:00:13.2181970 User mode CPU Time:

00:00:38.9404230 Total page faults:

4631

command

| rex field=_raw "Job Completed at :\s(?<completion_time>[^ \n\r]+)"

Re: How do I extract part of my sample log file?

somesoni2 — Thu, 11 Feb 2016 20:49:35 GMT

I don't see a colon ":" before the time in the data (as you'd see with Elapsed Time). So probably just remove that. Also, for Elapsed time there was only time part with no spaces in between, so you'd need a different rex for this.

  | rex field=_raw "Job Completed at\s+(?<completion_time>\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+\w+)"

Re: How do I extract part of my sample log file?

deenadp — Thu, 11 Feb 2016 21:01:56 GMT

sorry for the typo above. Below is the once I tried

>  | rex field=_raw "Job Completed at
> \s(?<completion_time>[^ \n\r]+)"

this shows the completion_time column but null values are in it... any ideas?

Re: How do I extract part of my sample log file?

somesoni2 — Thu, 11 Feb 2016 21:12:37 GMT

Another issue with your regex is that you've written both a space " " and \s (that's space too) after "at", but your data has just 1 space. Did you try the one I posted?

Re: How do I extract part of my sample log file?

deenadp — Thu, 11 Feb 2016 22:44:18 GMT

Yes, it worked smoothly.. Cool!!