Splunk Search

How to get max value of string inside braces

jsamadhan
New Member

Hi All,

I am new to splunk and need help in creating a table to get max value.
Below are my sample logs -

2017-05-25 14:21:06,757 INFO [http-/x.x.x.x.x:] [blablaServiceImpl] [myservices()][blablablablabla] [blablablablabla] [TOTAL_TIME_TAKEN][181]

Kindly help getting a table where max value of TOTAL_TIME_TAKEN will be displayed in (tabular foramat) per service

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
|  rex "^([^\]]+\]){2}\s*\[(?<service>.*?)\(\)\]([^\]]+\]){2}\s*\[TOTAL_TIME_TAKEN\]\s*\[(?<TOTAL_TIME_TAKEN>\d+)"
| stats max(TOTAL_TIME_TAKEN) BY service

adonio
Ultra Champion

if you have lets say 181 extracted as a value of TOTAL_TIME_TAKEN

... | stats max(TOTAL_TIME_TAKEN) by service ?
0 Karma

adonio
Ultra Champion

or... full solution by @woodcock

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...