Splunk Search

How do I extract part of my sample log file?

Explorer

Hi Team,

From the below portion of the log file, I want to display only the Elapsed Time: 01:05:22.0348974.
Can you pls help me with this?

-- 2/6/2016 11:02:42 AM
  Setup Completed
  Elapsed Time: 01:05:22.0348974
Setup Complete

Tried most of the suggested rex, but no luck:

| rex field=_raw "S(?<Elpased>\w*)"
0 Karma
1 Solution

Builder

Assuming the file is already indexed in Splunk, try this:

 | rex field=_raw "Elapsed Time:\s(?<elapsed_time>[^ \n\r]+)"

(Note: there's a space before \n\r)

View solution in original post

0 Karma

Explorer

sorry for the typo above. Below is the once I tried

>  | rex field=_raw "Job Completed at
> \s(?<completion_time>[^ \n\r]+)"

this shows the completion_time column but null values are in it... any ideas?

0 Karma

SplunkTrust
SplunkTrust

Another issue with your regex is that you've written both a space " " and \s (that's space too) after "at", but your data has just 1 space. Did you try the one I posted?

0 Karma

Explorer

Yes, it worked smoothly.. Cool!!

0 Karma

Explorer

Hi , I was able to fetch the Elapsed time as above but when I try the same for completion time, it doesn't display anything. pls advise If I need to change anything

Job Completed at 2/10/2016 12:10:26 PM
Elapsed Time:

00:09:43.7907662 Kernel mode CPU Time:
00:00:13.2181970 User mode CPU Time:

00:00:38.9404230 Total page faults:

4631

command

| rex field=_raw "Job Completed at :\s(?<completion_time>[^ \n\r]+)"
0 Karma

SplunkTrust
SplunkTrust

I don't see a colon ":" before the time in the data (as you'd see with Elapsed Time). So probably just remove that. Also, for Elapsed time there was only time part with no spaces in between, so you'd need a different rex for this.

  | rex field=_raw "Job Completed at\s+(?<completion_time>\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+\w+)"

Builder

Assuming the file is already indexed in Splunk, try this:

 | rex field=_raw "Elapsed Time:\s(?<elapsed_time>[^ \n\r]+)"

(Note: there's a space before \n\r)

View solution in original post

0 Karma