Splunk Search

Filtering out values and keeping the rest. How?

robertwatkins
Engager

I have a log file that shows times to complete certain tasks and I want to create a table of values. Unfortunately, there are some that show that no time has elapsed and I'd like to ignore them. (certainly, this ideas is suspect, but bear with me 🙂 )

Here is a sample of the data I have:

duration= 0:00:00
duration= 1:00:00
duration= 0:01:00
duration= 0:00:00

Here is the way I had considered capturing this, but I'm still getting the 0:00:00 values in my table.

rex field=_raw "duration= (?!0:00:00)(?<MyTime>.*) | table MyTime

What am I missing?

Tags (3)
1 Solution

BenjaminWyatt
Communicator

Perhaps there is a simpler way to accomplish this. Have you tried adding a "where" clause like:

| where NOT duration="0:00:00" | table MyTime

I do a lot of reporting where I use clauses like this to exclude zero-duration events from my charts and graphs.

Note that my method keeps the zero-duration field values in the data set, it just tells Splunk to exclude them from the reporting commands. Your method would actually remove the zero-duration field values altogether (though keeping the underlying events in the data set). So in that sense, your method is more thorough, but it may be more than you need for this use case. Does that make sense?

View solution in original post

BenjaminWyatt
Communicator

Perhaps there is a simpler way to accomplish this. Have you tried adding a "where" clause like:

| where NOT duration="0:00:00" | table MyTime

I do a lot of reporting where I use clauses like this to exclude zero-duration events from my charts and graphs.

Note that my method keeps the zero-duration field values in the data set, it just tells Splunk to exclude them from the reporting commands. Your method would actually remove the zero-duration field values altogether (though keeping the underlying events in the data set). So in that sense, your method is more thorough, but it may be more than you need for this use case. Does that make sense?

BenjaminWyatt
Communicator

Yay! I find that happens a lot with Splunk. I have a Splunk t-shirt that says, "See your world...maybe wish you hadn't."

0 Karma

robertwatkins
Engager

Yay! That fixed one problem (and exposed another for me to solve that I didn't know I had) 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...