I have Splunk logs like:
class,method,user,transactionType,,428856645467856301,1073258159,50213,5,2019-08-21 23:17:58.562,2019-08-21 23:17:58.994,432,,,,4,45170632,19634442,,,,159,52297220,801767,,,,,,,b4a954df-8c77-4a30-b4ac-68ec9afe9a48,,,,TransactionType=transactionType|
There would be many many logs of this format.
I now need to extract a couple of timestamps and populate in a table. Eg: '2019-08-21 23:17:58.562' and '2019-08-21 23:17:58.994,432' from the above log and display as:
-------------------------------------------------------------------
StartTime EndTime
-------------------------------------------------------------------
2019-08-21 23:17:58.562 2019-08-21 23:17:58.994
-------------------------------------------------------------------
Can someone please help?
Try this: Keep in mind that this only helps if the time placements are at the same position for all your log content. If your input is of csv format with all headers, extraction would have been easy
|makeresults
|eval _raw="class,method,user,transactionType,,428856645467856301,1073258159,50213,5,2019-08-21 23:17:58.562,2019-08-21 23:17:58.994,432,,,,4,45170632,19634442,,,,159,52297220,801767,,,,,,,b4a954df-8c77-4a30-b4ac-68ec9afe9a48,,,,TransactionType=transactionType"
|eval fields=split(_raw,",")
| eval Start_time=mvindex(fields,9), End_time=mvindex(fields,10)
| table Start_time End_time
Found this:
<mySearch> | rex "^(?:(?<TransactionStartTime>[^,]*),){10}" | rex "^(?:(?<TransactionEndTime>[^,]*),){11}" | table TransactionStartTime, TransactionEndTime
Try this: Keep in mind that this only helps if the time placements are at the same position for all your log content. If your input is of csv format with all headers, extraction would have been easy
|makeresults
|eval _raw="class,method,user,transactionType,,428856645467856301,1073258159,50213,5,2019-08-21 23:17:58.562,2019-08-21 23:17:58.994,432,,,,4,45170632,19634442,,,,159,52297220,801767,,,,,,,b4a954df-8c77-4a30-b4ac-68ec9afe9a48,,,,TransactionType=transactionType"
|eval fields=split(_raw,",")
| eval Start_time=mvindex(fields,9), End_time=mvindex(fields,10)
| table Start_time End_time
Yes. I understand Naresh. Thanks for your answer. I accept your answer as well.