Splunk Search

How to insert the values if match is found?

chitreshakumar
Communicator

I have duration 00:00:10.000000 i.e 00 hrs 00 mins 10 secs .But I want to add days also as my field has many values containing days also .SO is there any method to add " '00+' 00:00:10.000000" to the matched values "00:00:10.000000"??

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (will add 00+ to duration if it doesn't have day notation)

your current search with duration field say with name "duration"
| eval duration=if(match(duration,"^\d+\+",duration,"00+".duration)

View solution in original post

somesoni2
Revered Legend

Try like this (will add 00+ to duration if it doesn't have day notation)

your current search with duration field say with name "duration"
| eval duration=if(match(duration,"^\d+\+",duration,"00+".duration)

DalJeanis
Legend

@chitreshakumar - This one will work, or you can use the altered regex I put onto the other question.

0 Karma

niketn
Legend

@chitreshakumar are you looking for something like the following?

| makeresults
| eval durationInSec="12736,823321"
| fields - _time
| makemv durationInSec delim=","
| mvexpand durationInSec
| eval durationString=tostring(durationInSec,"duration")

If you are just looking for concatenating number of days to HH:MM:SS you can use eval with dot (.) or plus (+)

| makeresults
| eval durationString="00:00:10.000000"
| eval days="01"
| eval durationString=days."+".durationString

If it is not one of the above, please share your current query and data to add more details.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

chitreshakumar
Communicator

@niketnilay Thanks for the reply !!! I want something like second one .Since I have days values in some duration field 11+09:45:25.591549 .And in some values it is having "HH:MM:SS" so I want to add days .
At first I need to match only those values having HH:MM:SS then add days to it.I think I am clear about the requirement .Let me know if you want me to elaborate more

0 Karma

niketn
Legend

@chitreshakumar, refer to answer by @somesoni2. I think that is what you need.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...