Splunk Search

How to convert my time field for use in a timechart search?

subtrakt
Contributor

Any suggestions on how to timechart an unusual timestamp that comes inside the log entry.

These logs come in every night at midnight.

I want to run a scheduled search at 6pm that same day every day which charts the 'EXPIRES' field below as Time by CONTRACT

Here's the functional stats query:

index=contracts | rex "(?i)Contract (?P<CONTRACT>.*on+)(?P<EXPIRES>.*)" | stats count by CONTRACT, EXPIRES

log example:

Contract Honda Civic 144433 expires on Sun Feb 23 21:16:55 2015 GMT

Here's the EXPIRES field value that i would like to timechart:

Sun Nov 2 21:16:55 2014 GMT

Dysfunctional timechart search:

index=contracts | rex "(?i)contract (?P<CONTRACT>.*on+)(?P<EXPIRES>.*)" | timechart EXPIRES AS _time by CONTRACT
0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Just to make a tweak to your regex:

rex "Contract\s+(?P<CONTRACT>.+\s+expires on\s+)(?P<EXPIRES>.+)"

This cleanup will not put "expires" in the CONTRACT, prevent misparsing of the CONTRACT name (if there is "on" in the name), and eliminate the space at the front of EXPIRES.

Question: what result do you get from your dysfunctional query?

View solution in original post

cpetterborg
SplunkTrust
SplunkTrust

Just to make a tweak to your regex:

rex "Contract\s+(?P<CONTRACT>.+\s+expires on\s+)(?P<EXPIRES>.+)"

This cleanup will not put "expires" in the CONTRACT, prevent misparsing of the CONTRACT name (if there is "on" in the name), and eliminate the space at the front of EXPIRES.

Question: what result do you get from your dysfunctional query?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...