Splunk Search

How to get the value from the json file using regex?

anooshac
Communicator

Hi all,

I have a multiple json files. The format is like as below.

{
"ID": "123",
"TIME": "Jul 11, 2021, 08:55:54 AM",
"STATUS": "FAIL",
"DURATION": "4 hours, 32 minutes",
}

From these json files i want to use the DURATION field and convert the value into hours. After that i want to use these values of all the json files to plot a graph.

I have used regex to extract the value, but its not working. Below is the query that i have used.

| rex field=DURATION "(?<duration_hour>\d*)hours, ?(?<duration_minute>\d*)minutes"
| eval DURATION=duration_hour+(duration_minute)/60

can anyone please tell me what is mistake here?

Labels (2)
Tags (5)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Try this

| rex field=DURATION "(?<duration_hour>\d*)\shours, ?(?<duration_minute>\d*)\sminutes"
| eval DURATION=duration_hour+(duration_minute)/60

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Try this

| rex field=DURATION "(?<duration_hour>\d*)\shours, ?(?<duration_minute>\d*)\sminutes"
| eval DURATION=duration_hour+(duration_minute)/60
0 Karma

anooshac
Communicator

Thank you so much!! It is working properly.. Can you please explain that query?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Actually you did everything. I have just corrected your regular expressions

You missed space (\s) before hours and minutes

Happy Splukning

🙂 

0 Karma

anooshac
Communicator

yeah.. Got it! Thanks once again!!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...