Deployment Architecture

How to extract the time and place in buckets?

theouhuios
Motivator

Hello

I am trying to calculate the data on the basis of "next.breachtime" field in data. I need to create 4 fields with fields which have already been breached,0-4 hours till breached,4-8 hours till breached,greater than 8 hours. I understand the concept of using eval statements and case statements to get it done. I am getting stuck in the concept of extracting the data from that field a computing it into the buckets.

This is hoe that field will be in the data.

<nextBreachTime>10/25/2012 13:17:52</nextBreachTime>

This is what I am trying to use. Can anyone please tell me on how do I extract that data and place it in the case statements. I am thinking of using rex statements, but I am kinda new to that so finding it a bit difficult to understand how to write rex statements

eval mybucket=case(record.nextBreachTime=0,1,record.nextBreachTime<4,2,record.nextBreachTime<8,3,record.nextBreachTime>8,4)

Regards

theou

Tags (2)
0 Karma

lguinn2
Legend

I don't know what you mean by "until breached" or "already breached." Exactly what are you comparing the nextBreachTime to?

However, this rex command will extract the field for you and translate it into epoch time, so that you can do time arithmetic.

yoursearchhere
| rex "\<nextBreachTime\>(?<nextBreachTime>\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2})\</nextBreachTime\>"
| eval nextBreachTime=strptime(nextBreachTime,"%m/%d/%Y %H:%M:%S")

If you want to extract a large number of fields from xml-formatted input, take a look at the xmlkv command or the spath command.

Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...