How to Parse log file with time data in it to send Splunk alert?

[RS]

I have garbage collection event data in splunk. Below example line:

2022-06-26T21:47:53.142+0000: 8888.588: Total time for which process threads were stopped: 0.0015059 seconds, Stopping threads took: 0.0002620 seconds 2022-06-28T23:

2022-06-26T22:47:57.142+0000: 66666.588: Total time for which process threads were stopped: 0.0015059 seconds, Stopping threads took: 0.0002620 seconds 2022-06-28T23:

I have to create splunk alert that parses this Java garbage collected data ingested in Splunk and send alert  when the value in the above highlighted log line for seconds highlighted in red is greater than certain threshold.

I used splunk to create regex to extract the data (e.g. stopped: 0.0015059 seconds) as new filed.  I choose  auto regex as stopped: 0.0067871 seconds  The regex which was generated is ^(?:[^ \n]* ){9}(?P<pause>[^,]+)

When I use the where condition -->pause > 0, no event data is returned. Any idea how to manipulate number inside extracted new field such as above?

...|rex field=_raw ^(?:[^ \n]* ){9}(?P<pause>[^,]+)|where pause > 0

Thanks

[gcusello]

Hi @RS,

using your regex you extract a string containing both the string stopped and the pause, to take the pause, to use in the comparison you have to use a different regex:

| rex "stopped: (?P<pause>[^,]+)"
| where pause > 0

Ciao.

Giuseppe

[marysan]

Hi, this must work 
|rex field=a "stopped: "(?<pause>.*)" seconds,"
|where pause> 0

[VatsalJagani]

@RS - To use greater than you need to extract just the number.

| rex "stopped:\s*(?<pause>\d+(\.\d+)?)\s" | convert num(pause) | where pause>0

I hope this helps!!!