All Apps and Add-ons

How do i split a specific date format using rex field

umithchada
Explorer

Hello Team,

 

I have the specific data:

1-10:20:30 (This stands for 1 day 10 hours 20 minutes 30 seconds)

10:20:30 (This stands for 10 hours 20 minutes 30 seconds)

20:30 (This stands for 10 hours 20 minutes 30 seconds)

I would like to create a table where I get the output in seconds

ELAPSED |  seconds_elapsed

1-10:20:30  |  123630

10:20:30  |  37230

20:30  |  1230

 

Below is the rex format i am using to get this data. But for the last entry (20:30), i am getting an empty output. Is there a way to fix this?

| rex field=ELAPSED "((?<dd>\d+)\-?)((?<hh>\d+)\:?)((?<mm>\d+)\:)?(?<ss>\d+)$"
| eval elapsed_secs=(dd * 86400) + (hh * 3600) + (mm * 60) + (ss*1)
| table ELAPSED seconds_elapsed _time

 

Labels (1)
Tags (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @umithchada ,

please try this:

| rex field=ELAPSED "(?<dd>\d*)\-?(?<hh>\d*)\:?(?<mm>\d*)\:?(?<ss>\d*)$"
| eval elapsed_secs=(dd * 86400) + (hh * 3600) + (mm * 60) + (ss*1)
| table ELAPSED seconds_elapsed _time

You can test the regex at https://regex101.com/r/VfyG4S/1

Ciao.

Giuseppe

0 Karma

umithchada
Explorer

Hello,

Unfortunately this is giving me blank entries if the duration is under a day.

 

We figured it out, and this logic seems to be working:

 

| rex field=ELAPSED  "((?<dd>\d*)-?)?((?<hh>\d+):?)?((?<mm>\d*):?)?(?<ss>\d+)$"
| rex field=ELAPSED  "((?<hhh>\d+):?)?((?<mmm>\d*):?)?(?<sss>\d+)$"
| rex field=ELAPSED "((?<mmmm>\d*):?)?(?<ssss>\d+)$"
| eval dd=If(isnotnull(hh),dd,0)
| eval hhh=If('mm'='mmm',hhh,0)
| eval mm=If('ss'='ssss',mmmm,0)
| eval elapsed_secs = coalesce((if(isnotnull(dd),dd,0)*86400)+(if(isnotnull(hh),hh,0)*3600)+(if(isnotnull(mm),mm,0)*60)+if(isnotnull(ss),ss,0),0)
| table ELAPSED elapsed_secs

 

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...