Conversion of epoch time in rex extracted field

[adalbor]

Hey All,

Need some assistance with extracting/converting the epoch timestamps on index buckets from a search that I created.

This is what I have so far:

index=_internal sourcetype=splunkd log_level=INFO component=BucketMover "freeze succeeded"
| rex field=event_message "AsyncFreezer\s+(?\w+\s\w+).*lib/splunk/(?\w+)/\w+/(?.*)'"
| search NOT Index=_internaldb AND NOT Index=_introspection
| table _time host Action Index Bucket_Filename
| sort Index

I would like to extract the bucket beginning and ending timestamps and convert them into a human readable format so I can use those also.

Any assistance would be greatly appreciated!

Raw sample:
12-09-2019 10:54:56.422 -0600 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'

event_message sample:
AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'

[oscar84x · Accepted solution]

You could try extracting the two values separately and converting them like this:

|  makeresults
| eval data="AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1;;;
12-09-2019 10:54:56.422 -0600 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'"
| makemv delim=";;;" data
| mvexpand  data
|  rex field=data "rb\_(?<latest_epoch>\d+)\_(?<earliest_epoch>\d+)\_"
| eval latestEventInBucket=strftime(latest_epoch,"%m/%d/%y %H:%M:%S")
| eval earliestEventInBucket=strftime(earliest_epoch,"%m/%d/%y %H:%M:%S")

[adalbor]

The raw sample and the event_message sample don't need to be combined. I was just posting a raw and an extracted sample if it would help with writing something.

[oscar84x]

Yes. I did it that just to test it. I guess I didn't have to include everything, but the part that's relevant to your question is everything from the rex command and under. The regex in the rex command should find the format for the bucket naming convention regardless of the event's pattern.

[adalbor]

My hero!
That helped me a ton!

This is what I ended up with to get what I needed in the end:

index=_internal sourcetype=splunkd log_level=INFO component=BucketMover "freeze succeeded"
| rex field=event_message "AsyncFreezer\s+(?\w+\s\w+).*lib/splunk/(?\w+)/\w+/(?.*)'"
| search NOT Index=_internaldb AND NOT Index=_introspection
| rex field=Bucket_Filename "\Sb\_(?\d+)\_(?\d+)\_"
| eval latestEventInBucket=strftime(latest_epoch,"%m/%d/%y %H:%M:%S")
| eval earliestEventInBucket=strftime(earliest_epoch,"%m/%d/%y %H:%M:%S")
| table _time earliestEventInBucket latestEventInBucket host Action Index Bucket_Filename
| sort Index

[oscar84x]

Glad to help!