n00b log file parsing question

[jaywv6299]

I searched the Answers and the boards, but not effectively. I am trying to have splunk alert when days are greater than 20 days after "Duraton:" below:

2012-07-03 12:43:36,996 DEBUG [SessionManager] Session is: SESSION ID:NET\riquez1@cn=2bbeecf-49e5-9112-b787178c710a,RDP:0 Username:net\riquez START_TIME:Mon Jul 02 08:01:23 CDT 2012 STATE:CONNECTED PROTOCOL:RDP Duration:31 day 4 hours 42 minutes S-1-5-21-776561741-1390067357-839522115-53455] ConnectionId:7574376A4FE72E03C03D1167E44 SecurityServerName:null User SID:S-1-5-21-776561741

Thanks in Advance.

[sdaniels]

Splunk should automatically give you a field for Duration since it's a key value pair with a semi-colon separating it. Do you see this in the field discovery on the bottom left of the search screen?

Then create a search like this sourcetype=something | where Duration > 20. With that you can now create an alert for this condition. Depending on how often this occurs you'll want to choose a timeframe for your alert. Is it over the last month, week, day, hour etc, but that is configurable.

[lguinn2]

By default, Splunk only finds key-value pairs with an equal sign. If your data had

Duration=31

Then Splunk would automatically extract the duration field. But, as sdaniels suggested, you can use the Interactive Field Extractor to create a field, and then use the search as suggested.

[sdaniels]

To keep it simple use the field extractor. See link below, it will generate the regex for you. Enter several values like 31 etc from the raw events... and put them on seperate lines and then generate the regex, call the field what you want. Then perform the search using the new field.

http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample

[jaywv6299]

I do not see it as a key value. But if it did, wouldn't it be everything after the :, I only want to do Duration > 20, but it would have days, hours, etc after it.

How do I extract the entry so it is only "31" so I can perform the gt action?