My sample logs:
2022-11-12 04: 12:34, 123 [IMP] [application thread=1:00] - http:com.ap.ddd.group.ll.clentip.DDDLLClientApplication-<overalltimetaken> (100) 11/12/22 5:12 AM to 11/25/23 5:12 AM 4 hr DDDLLClientApplication - Done
2022-11-12 04: 12:34, 123 [IMP] [application thread=1:00] - http:com.ap.ddd.group.ll.clentip.DDDLLClientApplication-<overalltimetaken> (100) 11/12/22 5:12 AM to 11/25/23 5:12 AM 10 hr DDDLLClientApplication - Done
2022-11-12 04: 12:34, 123 [IMP] [application thread=1:00] - http:com.ap.ddd.group.ll.clentip.DDDLLClientApplication-<overalltimetaken> (100) 11/12/22 5:12 AM to 11/25/23 5:12 AM 12 hr DDDLLClientApplication - Done
here i want to get the response time from 12 hr ,10hr which are mentioned in the sample logs and i need to get the info by using the DDDLLClientApplication - Done
i want to do field extractions for response time and info
here i want to do via sourcetype, and the type should be inline
Do you mean the regex to use?
\s(?<reponse_time>\d+\s+hr)\s+DDDLLClientApplication - Done
Do you mean the regex to use?
\s(?<reponse_time>\d+\s+hr)\s+DDDLLClientApplication - Done