All Apps and Add-ons

TESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTEST

jayaraj1717
New Member
0 Karma

TISKAR
Builder

Hello,

To extract field from _raw you can use extract field page:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/FXSelectFieldsstep

Or use the rex command:

| makeresults 
| eval _raw="DT=2018-04-13T00:14:19.480-0700 | AppId=R4 | Level=INFO |LogBody=[UID:***:20180413xxxxxx:, Message Timestamp:2018-04-13 00:14:19.329" 
| rex "DT=(?<DT>.*?) \|.* Timestamp:(?<Timestamp>.*)$"

If you have any question comment this post please

0 Karma

jayaraj1717
New Member

Thanks @vinod94 @richgalloway @kmaron. i am able to progress with this

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

vinod94
Contributor

You can try this,

| makeresults 
| eval _raw = "DT=2018-04-13T00:14:19.480-0700 | AppId=R4 | Level=INFO |LogBody=[UID:***:20180413xxxxxx:, Message Timestamp:2018-04-13 00:14:19.329" 
| rex field=_raw "DT\=(?P<DT>[^\s]*)" 
| rex field=_raw "Timestamp\:(?P<timestamp>.*)" 
| eval DT=strptime(DT, "%Y-%m-%dT%H:%M:%S.%3N%z") 
| eval timestamp=strptime(timestamp, "%Y-%m-%d %H:%M:%S.%3N") 
| eval diff=DT-timestamp 
| eval diff=tostring(diff, "duration") 

richgalloway
SplunkTrust
SplunkTrust

Timestamp strings need to be converted into epoch (integer) form to be compared or subtracted. Try this:

... | rex field=LogBody "Timestamp:(?<LBtime>.{23})" | eval DTepoch=strptime(DT, "%Y-%m-%dT%H:%M:%S.%3N%z"), LBepoch=strftime(LBtime,"%Y-%m-%d %H:%M:%S.%3N") | eval ResponseTime=DTepoch - LBepoch | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma

kmaron
Motivator

I think this will get you close:

| makeresults 
| eval _raw = "DT=2018-04-13T00:14:19.480-0700 | AppId=R4 | Level=INFO |LogBody=[UID:***:20180413xxxxxx:, Message Timestamp:2018-04-13 00:14:19.329" 
| rex field=_raw "DT=(?<DT>.*?) \|" 
| rex field=_raw "Message Timestamp:(?<Timestamp>.*?)$"
| eval start= strptime(DT,"%Y-%m-%dT%H:%M:%S.%3N%z")
| eval end= strptime(Timestamp,"%Y-%m-%d %H:%M:%S.%3N")
| eval responsetime = start-end
| eval responsetime = strftime(responsetime, "%H:%M")

The two timestamps are pulled out with rex into fields DT and Timestamp.
The strptime converts them into UNIX time to subtract them and then strftime puts them back into hour:minute

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!