How to extract time from the below message?

[peterfox1992]

Hi Folks,

Can someone help me on the below. I have the below message in the log and need to extract the time portion alone.

[END~~Method.Search_Button] Response Time Search_Button: 00:00:00.3004626

The output I need is,

00:00:00.3004626

Also if possible, can suggest how I can get the value as millisecond? For the above message, I should get 300ms.

If the output is "00:00:01.250" then i should get as 1250ms.

Thanks.

[peterfox1992]

Thanks @gcusello . I have got the required result by using the rex command mentioned.

Now is there any possible to convert the time in millisecond?

If the output is "00:00:01.250" then i should get as 1250ms.

[gcusello · Accepted solution]

Hi @peterfox1992,

after the rex command you have to use the eval command for the convertion:

| rex "Search_Button:\s+(?<hours>\d\d):/?<minutes>\d\d):(?<seconds>\d\d\)\.(?<milliseconds>\d\d\d\d\d\d)"
| eval time_milliseconds=(hours*3600+minutes*60+seconds)*1000+milliseconds

Ciao.

Giuseppe

[peterfox1992]

Thanks @gcusello . It worked 🙂 

Cheers!

[gcusello]

Hi @peterfox1992,

are you speaking of extract time as a field or as the event TimeStamp?

if as a field, you can use a regex like the following:

| rex "Search_Button:\s+(?<time>\d\d:\d\d:\d\d\.\d\d\d\d\d\d"

if as timestamp, in sourcetype (props.conf) you have to define the following parameters:

[your_sourcetype]
TIME_PREFIX = Search_Button:\s
TIME_FORMAT = %H:%M:%S.%6N

Ciao.

Giuseppe

[peterfox1992]

Thanks @gcusello . I have got the required result by using the rex command mentioned.

Now is there any possible to convert the time in millisecond?

If the output is "00:00:01.250" then i should get as 1250ms.