Splunk Search

How to extract field as time in ms after occurrence of a string


Here is a log example - 

{"log_time":"2021-08-27T07:16:46.178275260+00:00","output":"stdout","log":"2021-08-27 07:16:46.178 [INFO ] [her-49] a.a.ActorSystemImpl - Logged Request:HttpMethod(POST):http://id-test.api-gateway.sit.ls.api.com/repos/hrn:idmrepo-sit::ol:idm_team_internal_test/ids/getOrCreate/bulk?streaming=true&dscid=GvaIrM-cb4005f6-a828-4fd7-9f54-6082e2912716:200 OK:4","k8scluster":"borg-dev-1-aws-west-1","namespace":"*","env":"DEV","app_time":"","time":"1630048606.178275260"}


I need to extract the digits after "OK:" (here highlighted in red color) as time in ms. 
I am just started using splunk. I am trying this - 

rex "([^\:]+$)(?P<duration>.+)" | stats exactperc98(duration) as P98 avg(duration) as AVG by log

But this is not working.

Labels (4)
Tags (4)
0 Karma

Super Champion

Given that you appear to have a field name 'log' already, which is the data from your JSON example, then if that's the field you need to extract duration from, then 


| rex field=log "OK:(?<duration>\d+)"


Note that if the encapsulated log didn't result in a 200 OK response, then of course this will not work


It's always best if you have the whole event parsed so you don't accidentaly hit some unexpected string occurrence in other part of the event. But anyway, it should be quite simple

| rex "OK:(?<duration>\d+)\"" | <<your stats>>
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!