TESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTESTTEST

[jayaraj1717]

TEST

[TISKAR]

Hello,

To extract field from _raw you can use extract field page:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/FXSelectFieldsstep

Or use the rex command:

| makeresults 
| eval _raw="DT=2018-04-13T00:14:19.480-0700 | AppId=R4 | Level=INFO |LogBody=[UID:***:20180413xxxxxx:, Message Timestamp:2018-04-13 00:14:19.329" 
| rex "DT=(?<DT>.*?) \|.* Timestamp:(?<Timestamp>.*)$"

If you have any question comment this post please

[jayaraj1717]

Thanks @vinod94 @richgalloway @kmaron. i am able to progress with this

[richgalloway]

If your problem is resolved, please accept an answer to help future readers.

[vinod94]

You can try this,

| makeresults 
| eval _raw = "DT=2018-04-13T00:14:19.480-0700 | AppId=R4 | Level=INFO |LogBody=[UID:***:20180413xxxxxx:, Message Timestamp:2018-04-13 00:14:19.329" 
| rex field=_raw "DT\=(?P<DT>[^\s]*)" 
| rex field=_raw "Timestamp\:(?P<timestamp>.*)" 
| eval DT=strptime(DT, "%Y-%m-%dT%H:%M:%S.%3N%z") 
| eval timestamp=strptime(timestamp, "%Y-%m-%d %H:%M:%S.%3N") 
| eval diff=DT-timestamp 
| eval diff=tostring(diff, "duration") 

[richgalloway]

Timestamp strings need to be converted into epoch (integer) form to be compared or subtracted. Try this:

... | rex field=LogBody "Timestamp:(?<LBtime>.{23})" | eval DTepoch=strptime(DT, "%Y-%m-%dT%H:%M:%S.%3N%z"), LBepoch=strftime(LBtime,"%Y-%m-%d %H:%M:%S.%3N") | eval ResponseTime=DTepoch - LBepoch | ...

[kmaron]

I think this will get you close:

| makeresults 
| eval _raw = "DT=2018-04-13T00:14:19.480-0700 | AppId=R4 | Level=INFO |LogBody=[UID:***:20180413xxxxxx:, Message Timestamp:2018-04-13 00:14:19.329" 
| rex field=_raw "DT=(?<DT>.*?) \|" 
| rex field=_raw "Message Timestamp:(?<Timestamp>.*?)$"
| eval start= strptime(DT,"%Y-%m-%dT%H:%M:%S.%3N%z")
| eval end= strptime(Timestamp,"%Y-%m-%d %H:%M:%S.%3N")
| eval responsetime = start-end
| eval responsetime = strftime(responsetime, "%H:%M")

The two timestamps are pulled out with rex into fields DT and Timestamp.
The strptime converts them into UNIX time to subtract them and then strftime puts them back into hour:minute