Splunk Search

How do i regex the numbers for the following hung thread log message...?

prakash007
Builder

Looking for a regex in 612,200(threadDuration) and 3(no.of.Threads) for the log message below...

WSVR0605W: Thread “WebContainer : 1” has been active for 612,000 milliseconds and may be hung. There are 3 threads in total in the server that may be hung.
Tags (2)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Here's a regex that will extract the number of ms

The field is called Time

... | rex (?P<Time>(?<=been\sactive\sfor\s)\d+\,\d+(?=\smilliseconds))

Here's the regex for number of threads which the field is called Threads

... | rex (?P<Threads>(?<=There\sare\s)\d)

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

Here's a regex that will extract the number of ms

The field is called Time

... | rex (?P<Time>(?<=been\sactive\sfor\s)\d+\,\d+(?=\smilliseconds))

Here's the regex for number of threads which the field is called Threads

... | rex (?P<Threads>(?<=There\sare\s)\d)

richgalloway
SplunkTrust
SplunkTrust

This works on regex101.com with your sample event.

... | rex "for (?<threadDuration>[\d,]+).*?(?<threadCount>\d+) threads" | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...