Splunk Search

How to insert the values if match is found?

chitreshakumar
Communicator

I have duration 00:00:10.000000 i.e 00 hrs 00 mins 10 secs .But I want to add days also as my field has many values containing days also .SO is there any method to add " '00+' 00:00:10.000000" to the matched values "00:00:10.000000"??

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (will add 00+ to duration if it doesn't have day notation)

your current search with duration field say with name "duration"
| eval duration=if(match(duration,"^\d+\+",duration,"00+".duration)

View solution in original post

somesoni2
Revered Legend

Try like this (will add 00+ to duration if it doesn't have day notation)

your current search with duration field say with name "duration"
| eval duration=if(match(duration,"^\d+\+",duration,"00+".duration)

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

@chitreshakumar - This one will work, or you can use the altered regex I put onto the other question.

0 Karma

niketnilay
Legend

@chitreshakumar are you looking for something like the following?

| makeresults
| eval durationInSec="12736,823321"
| fields - _time
| makemv durationInSec delim=","
| mvexpand durationInSec
| eval durationString=tostring(durationInSec,"duration")

If you are just looking for concatenating number of days to HH:MM:SS you can use eval with dot (.) or plus (+)

| makeresults
| eval durationString="00:00:10.000000"
| eval days="01"
| eval durationString=days."+".durationString

If it is not one of the above, please share your current query and data to add more details.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

chitreshakumar
Communicator

@niketnilay Thanks for the reply !!! I want something like second one .Since I have days values in some duration field 11+09:45:25.591549 .And in some values it is having "HH:MM:SS" so I want to add days .
At first I need to match only those values having HH:MM:SS then add days to it.I think I am clear about the requirement .Let me know if you want me to elaborate more

0 Karma

niketnilay
Legend

@chitreshakumar, refer to answer by @somesoni2. I think that is what you need.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!