Splunk Search

Conversion of epoch time in rex extracted field

adalbor
Builder

Hey All,

Need some assistance with extracting/converting the epoch timestamps on index buckets from a search that I created.

This is what I have so far:

index=_internal sourcetype=splunkd log_level=INFO component=BucketMover "freeze succeeded"
| rex field=event_message "AsyncFreezer\s+(?\w+\s\w+).*lib/splunk/(?\w+)/\w+/(?.*)'"
| search NOT Index=_internaldb AND NOT Index=_introspection
| table _time host Action Index Bucket_Filename
| sort Index

I would like to extract the bucket beginning and ending timestamps and convert them into a human readable format so I can use those also.

Any assistance would be greatly appreciated!

Raw sample:
12-09-2019 10:54:56.422 -0600 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'

event_message sample:
AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'

0 Karma
1 Solution

oscar84x
Contributor

You could try extracting the two values separately and converting them like this:

|  makeresults
| eval data="AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1;;;
12-09-2019 10:54:56.422 -0600 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'"
| makemv delim=";;;" data
| mvexpand  data
|  rex field=data "rb\_(?<latest_epoch>\d+)\_(?<earliest_epoch>\d+)\_"
| eval latestEventInBucket=strftime(latest_epoch,"%m/%d/%y %H:%M:%S")
| eval earliestEventInBucket=strftime(earliest_epoch,"%m/%d/%y %H:%M:%S")

View solution in original post

0 Karma

oscar84x
Contributor

You could try extracting the two values separately and converting them like this:

|  makeresults
| eval data="AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1;;;
12-09-2019 10:54:56.422 -0600 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'"
| makemv delim=";;;" data
| mvexpand  data
|  rex field=data "rb\_(?<latest_epoch>\d+)\_(?<earliest_epoch>\d+)\_"
| eval latestEventInBucket=strftime(latest_epoch,"%m/%d/%y %H:%M:%S")
| eval earliestEventInBucket=strftime(earliest_epoch,"%m/%d/%y %H:%M:%S")

View solution in original post

0 Karma

adalbor
Builder

The raw sample and the event_message sample don't need to be combined. I was just posting a raw and an extracted sample if it would help with writing something.

0 Karma

oscar84x
Contributor

Yes. I did it that just to test it. I guess I didn't have to include everything, but the part that's relevant to your question is everything from the rex command and under. The regex in the rex command should find the format for the bucket naming convention regardless of the event's pattern.

0 Karma

adalbor
Builder

My hero!
That helped me a ton!

This is what I ended up with to get what I needed in the end:

index=_internal sourcetype=splunkd log_level=INFO component=BucketMover "freeze succeeded"
| rex field=event_message "AsyncFreezer\s+(?\w+\s\w+).*lib/splunk/(?\w+)/\w+/(?.*)'"
| search NOT Index=_internaldb AND NOT Index=_introspection
| rex field=Bucket_Filename "\Sb\_(?\d+)\_(?\d+)\_"
| eval latestEventInBucket=strftime(latest_epoch,"%m/%d/%y %H:%M:%S")
| eval earliestEventInBucket=strftime(earliest_epoch,"%m/%d/%y %H:%M:%S")
| table _time earliestEventInBucket latestEventInBucket host Action Index Bucket_Filename
| sort Index

oscar84x
Contributor

Glad to help!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.