Deployment Architecture

How to extract the time and place in buckets?

theouhuios
Motivator

Hello

I am trying to calculate the data on the basis of "next.breachtime" field in data. I need to create 4 fields with fields which have already been breached,0-4 hours till breached,4-8 hours till breached,greater than 8 hours. I understand the concept of using eval statements and case statements to get it done. I am getting stuck in the concept of extracting the data from that field a computing it into the buckets.

This is hoe that field will be in the data.

<nextBreachTime>10/25/2012 13:17:52</nextBreachTime>

This is what I am trying to use. Can anyone please tell me on how do I extract that data and place it in the case statements. I am thinking of using rex statements, but I am kinda new to that so finding it a bit difficult to understand how to write rex statements

eval mybucket=case(record.nextBreachTime=0,1,record.nextBreachTime<4,2,record.nextBreachTime<8,3,record.nextBreachTime>8,4)

Regards

theou

Tags (2)
0 Karma

lguinn2
Legend

I don't know what you mean by "until breached" or "already breached." Exactly what are you comparing the nextBreachTime to?

However, this rex command will extract the field for you and translate it into epoch time, so that you can do time arithmetic.

yoursearchhere
| rex "\<nextBreachTime\>(?<nextBreachTime>\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2})\</nextBreachTime\>"
| eval nextBreachTime=strptime(nextBreachTime,"%m/%d/%Y %H:%M:%S")

If you want to extract a large number of fields from xml-formatted input, take a look at the xmlkv command or the spath command.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!