Splunk Search

How to get a numeric field extracted

Regleston
New Member

I am trying to extract the "Time taken" from this field.

2019-11-20 09:38:22,157 INFO Time taken: 01:35:53.514

The problem I have is that when I use Splunk to create a regex it creates it as an "a".
From what I understand that happens when more then half of the characters aren't numeric.
As you can see there are 12 chars, 9 of which are numeric, so I am not sure why this field is created as an "a" and not a "#".

Can anyone please help?

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | rex "Time taken:\s(?:(?:(?<duration_hours>\d+):)?(?<duration_minutes>\d+):)?(?<duration_seconds>.+)$"
| fillnull value=0 duration_hours duration_minutes 
| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours))) 
| fieldformat duration = tostring(duration, "duration")

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "Time taken:\s(?:(?:(?<duration_hours>\d+):)?(?<duration_minutes>\d+):)?(?<duration_seconds>.+)$"
| fillnull value=0 duration_hours duration_minutes 
| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours))) 
| fieldformat duration = tostring(duration, "duration")
0 Karma

Regleston
New Member

Thanks jpolvino & woodcock for the advice. I made regex for hh mm ss nnn and used the parsing woodcock provided and I am all smiles.

0 Karma

jpolvino
Builder

You can change the type, see link

But why do you want to change it? The time taken is clearly not a number. How about parsing it apart and then doing calculations to render it into an actual numeric type, such as seconds?

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...