How to extract the time and place in buckets?

[theouhuios]

Hello

I am trying to calculate the data on the basis of "next.breachtime" field in data. I need to create 4 fields with fields which have already been breached,0-4 hours till breached,4-8 hours till breached,greater than 8 hours. I understand the concept of using eval statements and case statements to get it done. I am getting stuck in the concept of extracting the data from that field a computing it into the buckets.

This is hoe that field will be in the data.

<nextBreachTime>10/25/2012 13:17:52</nextBreachTime>

This is what I am trying to use. Can anyone please tell me on how do I extract that data and place it in the case statements. I am thinking of using rex statements, but I am kinda new to that so finding it a bit difficult to understand how to write rex statements

eval mybucket=case(record.nextBreachTime=0,1,record.nextBreachTime<4,2,record.nextBreachTime<8,3,record.nextBreachTime>8,4)

Regards

theou

[lguinn2]

I don't know what you mean by "until breached" or "already breached." Exactly what are you comparing the nextBreachTime to?

However, this rex command will extract the field for you and translate it into epoch time, so that you can do time arithmetic.

yoursearchhere
| rex "\<nextBreachTime\>(?<nextBreachTime>\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2})\</nextBreachTime\>"
| eval nextBreachTime=strptime(nextBreachTime,"%m/%d/%Y %H:%M:%S")

If you want to extract a large number of fields from xml-formatted input, take a look at the xmlkv command or the spath command.