Filtering out values and keeping the rest. How?

[robertwatkins]

I have a log file that shows times to complete certain tasks and I want to create a table of values. Unfortunately, there are some that show that no time has elapsed and I'd like to ignore them. (certainly, this ideas is suspect, but bear with me 🙂 )

Here is a sample of the data I have:

duration= 0:00:00
duration= 1:00:00
duration= 0:01:00
duration= 0:00:00

Here is the way I had considered capturing this, but I'm still getting the 0:00:00 values in my table.

rex field=_raw "duration= (?!0:00:00)(?<MyTime>.*) | table MyTime

What am I missing?

[BenjaminWyatt · Accepted solution]

Perhaps there is a simpler way to accomplish this. Have you tried adding a "where" clause like:

| where NOT duration="0:00:00" | table MyTime

I do a lot of reporting where I use clauses like this to exclude zero-duration events from my charts and graphs.

Note that my method keeps the zero-duration field values in the data set, it just tells Splunk to exclude them from the reporting commands. Your method would actually remove the zero-duration field values altogether (though keeping the underlying events in the data set). So in that sense, your method is more thorough, but it may be more than you need for this use case. Does that make sense?

[BenjaminWyatt]

Yay! I find that happens a lot with Splunk. I have a Splunk t-shirt that says, "See your world...maybe wish you hadn't."

[robertwatkins]

Yay! That fixed one problem (and exposed another for me to solve that I didn't know I had) 🙂