Extract Milliseconds

[IRHM73]

Hi, I wonder whether someone could help me please.

I'm using the query below to extract information about searches that have been performed.

|rest /services/search/jobs
|rename custom.search as customSearch
|search NOT author="splunk-system-user"
|eval SearchString=if(isnotnull(customSearch),customSearch,eventSearch)
|search SearchString!=""
|convert ctime(searchEarliestTime) as STime timeformat=%d/%m/%y
|convert ctime(searchLatestTime) as LTime timeformat=%d/%m/%y
|addtotals fieldname=duration *duration_secs
|convert rmunit(duration) as numSecs
|eval stringSecs=tostring(duration,"duration")
|eval stringSecs = replace(stringSecs,"(\d+)\:(\d+)\:(\d+)","\1h \2min \3s")
|table author SearchString duration stringSecs

I'm having a little difficulty with this line: eval stringSecs = replace(stringSecs,"(\d+)\:(\d+)\:(\d+)","\1h \2min \3s")

Could someone tell me please how I could change this to display the milliseconds as "ms" in the same vain in which the hours, minutes and seconds are shown.

I've tried the obvious eval stringSecs = replace(stringSecs,"(\d+)\:(\d+)\:(\d+)\.(\d+)","\1h \2min \3s \4ms") but this doesn't work.

I just wondered whether someone could point out where I've gone wrong please.

Many thanks and kind regards

Chris

[jeffland]

|eval stringSecs = replace(stringSecs,"(\d+)\:(\d+)\:(\d+)\.(\d+)","\1h \2min \3s \4ms")

works fine for me. Are you sure you used exactly that line? I don't see a reason it shouldn't do the trick.

[MuS]

Hi Jeffland,

Yes, this works - but it will give you a 6 digit value for milliseconds and I reckon @IRHM73 was after a 2-3 digit millisecond value.

cheers, MuS

[jeffland]

If so, I didn't recognize that - I assumed that since he wants to display "00h" if the duration was less than an hour, he also wants all digits including zeros in the milliseconds.
@IRHM73, if you want to exclude trailing zeros, the following should do that:

| eval stringSecs = replace(stringSecs,"(\d+)\:(\d+)\:(\d+)\.(\d+?)0*$","\1h \2min \3s \4ms")

Of course the same logic can be applied to the rex-variant proposed by MuS 🙂

[IRHM73]

Hi @jeffland, no that's absolutely fine. Thank you for coming back to me with this I really appreciate it.

Many thanks and kind regards

Chris

[IRHM73]

Hi @jeffland, thank you for this. I can now get this to work. I can only assume that this was a typo in my original query.

Many thanks and kind regards

Chris

[MuS · Accepted solution]

Hi IRHM73,

Although this was asked before 😉 I'll try to answer it again - use this search:

|rest /services/search/jobs
 |rename custom.search as customSearch
 |search NOT author="splunk-system-user"
 |eval SearchString=if(isnotnull(customSearch),customSearch,eventSearch)
 |search SearchString!=""
 |convert ctime(searchEarliestTime) as STime timeformat=%d/%m/%y
 |convert ctime(searchLatestTime) as LTime timeformat=%d/%m/%y
 |addtotals fieldname=duration *duration_secs
 |convert rmunit(duration) as numSecs
 |eval stringSecs=tostring(duration,"duration")
 |eval stringSecs = replace(stringSecs,"(\d+)\:(\d+)\:(\d+)","\1h \2min \3s")
 | rex field=stringSecs "\.(?<ms>\d{3})" | rex field=stringSecs "(?<myRest>.+)s\." | eval stringSecs=myRest. "s " .ms. "ms"
 |table author SearchString duration stringSecs

It has an additional line with rex and eval to get milliseconds in the result.

Hope this helps and works for you ...

cheers, MuS

[IRHM73]

Hi @Mus yes it was asked before but I couldn't get this to work as I alluded to in that post, and I wasn't sure about the protocol of raising new posts and linking to prior ones.

Anyway the solution you posted above works great, thank you for taking the time to come back to me with this.

Many thanks and kind regards

Chris