How do I extract part of my sample log file?

[deenadp]

Hi Team,

From the below portion of the log file, I want to display only the Elapsed Time: 01:05:22.0348974.
Can you pls help me with this?

-- 2/6/2016 11:02:42 AM
  Setup Completed
  Elapsed Time: 01:05:22.0348974
Setup Complete

Tried most of the suggested rex, but no luck:

| rex field=_raw "S(?<Elpased>\w*)"

[deenadp]

sorry for the typo above. Below is the once I tried

>  | rex field=_raw "Job Completed at
> \s(?<completion_time>[^ \n\r]+)"

this shows the completion_time column but null values are in it... any ideas?

[somesoni2]

Another issue with your regex is that you've written both a space " " and \s (that's space too) after "at", but your data has just 1 space. Did you try the one I posted?

[deenadp]

Yes, it worked smoothly.. Cool!!

[deenadp]

Hi , I was able to fetch the Elapsed time as above but when I try the same for completion time, it doesn't display anything. pls advise If I need to change anything

Job Completed at 2/10/2016 12:10:26 PM
Elapsed Time:

00:09:43.7907662 Kernel mode CPU Time:
00:00:13.2181970 User mode CPU Time:

00:00:38.9404230 Total page faults:

4631

command

| rex field=_raw "Job Completed at :\s(?<completion_time>[^ \n\r]+)"

[somesoni2]

I don't see a colon ":" before the time in the data (as you'd see with Elapsed Time). So probably just remove that. Also, for Elapsed time there was only time part with no spaces in between, so you'd need a different rex for this.

  | rex field=_raw "Job Completed at\s+(?<completion_time>\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+\w+)"

[sk314 · Accepted solution]

Assuming the file is already indexed in Splunk, try this:

 | rex field=_raw "Elapsed Time:\s(?<elapsed_time>[^ \n\r]+)"

(Note: there's a space before \n\r)