Splunk Search

How to get max value of string inside braces

jsamadhan
New Member

Hi All,

I am new to splunk and need help in creating a table to get max value.
Below are my sample logs -

2017-05-25 14:21:06,757 INFO [http-/x.x.x.x.x:] [blablaServiceImpl] [myservices()][blablablablabla] [blablablablabla] [TOTAL_TIME_TAKEN][181]

Kindly help getting a table where max value of TOTAL_TIME_TAKEN will be displayed in (tabular foramat) per service

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
|  rex "^([^\]]+\]){2}\s*\[(?<service>.*?)\(\)\]([^\]]+\]){2}\s*\[TOTAL_TIME_TAKEN\]\s*\[(?<TOTAL_TIME_TAKEN>\d+)"
| stats max(TOTAL_TIME_TAKEN) BY service

adonio
Ultra Champion

if you have lets say 181 extracted as a value of TOTAL_TIME_TAKEN

... | stats max(TOTAL_TIME_TAKEN) by service ?
0 Karma

adonio
Ultra Champion

or... full solution by @woodcock

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...