Dashboards & Visualizations

How to Parse log file with time data in it to send Splunk alert?

RS
Engager

I have garbage collection event data in splunk. Below example line:

2022-06-26T21:47:53.142+0000: 8888.588: Total time for which process threads were stopped: 0.0015059 seconds, Stopping threads took: 0.0002620 seconds 2022-06-28T23:

2022-06-26T22:47:57.142+0000: 66666.588: Total time for which process threads were stopped: 0.0015059 seconds, Stopping threads took: 0.0002620 seconds 2022-06-28T23:

I have to create splunk alert that parses this Java garbage collected data ingested in Splunk and send alert  when the value in the above highlighted log line for seconds highlighted in red is greater than certain threshold.

I used splunk to create regex to extract the data (e.g. stopped: 0.0015059 seconds) as new filed.  I choose  auto regex as stopped: 0.0067871 seconds  The regex which was generated is ^(?:[^ \n]* ){9}(?P<pause>[^,]+)

When I use the where condition -->pause > 0, no event data is returned. Any idea how to manipulate number inside extracted new field such as above?

...|rex field=_raw ^(?:[^ \n]* ){9}(?P<pause>[^,]+)|where pause > 0

Thanks

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @RS,

using your regex you extract a string containing both the string stopped and the pause, to take the pause, to use in the comparison you have to use a different regex:

| rex "stopped: (?P<pause>[^,]+)"
| where pause > 0

Ciao.

Giuseppe

 

0 Karma

marysan
Communicator

Hi, this must work 
|rex field=a "stopped: "(?<pause>.*)" seconds,"

|where pause> 0

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@RS - To use greater than you need to extract just the number.

| rex "stopped:\s*(?<pause>\d+(\.\d+)?)\s" | convert num(pause) | where pause>0

 

I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...