Greater than filter

[lanode]

This is a record from within my splunk index.

11/01/12 13:03 214 0004 1234567890 00:01'36

It is a call record from our PBX and the final part 00:01'36 shows the call duration. (Hr:Min'Sec)

I am trying to construct a filter that displays ALL records that have a duration greater than 00:00'30 or 30 seconds and am struggling to do this.

Any help would be much appreciated.

[lanode]

I have found a suitable solution to this problem.
Using the suggested regualr expression tool at - http://gskinner.com/RegExr/ - I was able to quickly formulate a regex that identified the required 'duration' characters within each record and then select only those records that exceeded a specified 'duration'.

So a big thank you to 'sowings' for their help.

Very much appreciated.

[lanode]

Great! - Thanks, I will investigate further

[sowings]

There is a regular expression tool at http://gskinner.com/RegExr/, you can try it directly. A regex for what you want might look like (?<hour>\d{2}):(?<min>\d{2})'(?<sec>\d{2})$. The $ means "anchored at the end of the line".

[lanode]

Thank you for your quick repsonse.

You say you would begin by creating a regular expression to capture hour, min and second of the record.

Part of the problem I'm wrestling with is the construction of such an expression.

Any pointers would be most greatfully received.

[sowings · Accepted solution]

I would begin by creating a regular expression to capture hour, min, and second of that record, then perform eval math (sec + (60 * (min + (60 * hour)))), then sort by the new field.