A job needs to be completed by 04:45 AM,
Can some one help me to extract time from the logs, compare 04:45 AM and send an alert.
Thanks for your reply.
In the logs, we have OSTIME field. From OSTIME, we need to extract %H:%M.
Everyday this value need to compare with 04:45, to check the job is runningeven after 04:45 AM
The time format in logs looks like below
Mkay... assuming the field
OSTIME is already extracted, do something like this:
... | rex field=OSTIME "(?<OS_hour>\d+):(?<OS_minute>\d+)" | eval too_late = if(OS_hour * 60 + OS_minute > 285, "yes", "no")
I'm not treating it as a date because you're not interested in the date, or the entire timestamp. You're just looking to compare the
HH:MM portion to see if more than 285 minutes have elapsed since midnight. An alternative, approach using the entire timestamp would be this:
... | eval OSTIME_epoch = strptime(OSTIME, "%m/%d/%Y %H:%M:%S") | eval too_late = if((OSTIME_epoch - relative_time(OSTIME_epoch, "@d")) > (285*60), "yes", "no")
However, this may fail when combined with daylight savings changes... more or less time will have elapsed on those two days when it is 04:45.