How to extract these fields from my sample data?

[mcvr]

I wanted to extract the below values.

1. Time Taken
2. Response code in the string - HTTP/1.1" 200 example, I need to know what the response code is, whether 200/404/500

Sample data:

 Time Taken: 937534 URL_STRING: /account/signin.jsp 95.104.163.4 - - [27/Jul/2015:02:10:34 -0700] "GET /account/signin.jsp?PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374304776473&bmUID=kX4Nj97 HTTP/1.1" 200 Bytes: 97413 "http://www.xxx.com/shop/dept_category.jsp?productSizeSelected=0&pageClicked=0&PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374306291898&bmUID=kX4NaK4" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 YaBrowser/15.6.2311.5029 Safari/537.36"

[somesoni2]

See if this works (run anywhere sample based on your data)

| gentimes start=-1 | eval temp="Time Taken: 937534 URL_STRING: /account/signin.jsp 95.104.163.4 - - [27/Jul/2015:02:10:34 -0700] \"GET /account/signin.jsp?PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374304776473&bmUID=kX4Nj97 HTTP/1.1\" 200 Bytes: 97413 \"http://www.xxx.com/shop/dept_category.jsp?productSizeSelected=0&pageClicked=0&PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374306291898&bmUID=kX4NaK4\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 YaBrowser/15.6.2311.5029 Safari/537.36\"" | table temp | rename temp as _raw | rex "Time Taken: (?<TimeTaken>\d+)([^\"]+)\"([^\"]+)\" (?<ResponseCode>\d+)"

[krishnarajapant]

Hi,

1. timetaken------- rex "Time Taken:(?\d*)"

2. status---------- rex "HTTP/\d.\d\"(?\d*)"

you can try with erex command and can get the proper regular expression from job or you can use the knowlede object "field extraction" so that you can get the base regular expression.

Above regular expression required little bit tweaking and testing.

-Krishan Rajapantula.