How to parse p4 logs

[vinodarokiya]

2020/11/12 12:37:17 pid 282689 compute end .028s 23+5us 0+32io 0+0net 16472k 0pf Perforce server info: Server network estimates: files added/updated/deleted=0/0/0, bytes added/updated=0/0

2020/11/12 08:53:57 pid 249917 xyz@admin-client-for-stag 127.0.0.1 [p4/2018.1/LINUX26X86_64/1738923] 'user-sizes //ddc/...' --- lapse 98.5s --- rpc msgs/size in+out 0+1814189/0mb+509mb himarks 795800/318788 snd/rcv 92.8s/.000s --- db.revhx --- locks read/write 1/0 rows get+pos+scan put+del 0+1+1814190 0+0

2020/11/12 08:21:39 pid 245315 xyz@Admin-client-for-stag 127.0.0.1 [p4/2018.1/LINUX26X86_64/1738923] 'user-sizes -s -a -b 512 //mapgrp/...' --- lapse 106s --- usage 51584+13969us 75284368+0io 0+0net 8832k 0pf --- db.rev --- pages in+out+cached 4704508+0+96

2020/11/12 08:14:10 pid 243592 yyyz@admin-client-for-stag 127.0.0.1 [p4/2018.1/LINUX26X86_64/1738923] 'user-sizes -s -a -b 512 //projects/...' --- lapse 80.4s --- usage 38774+9874us 49562128+0io 0+0net 8832k 0pf --- db.rev --- pages in+out+cached 3374543+0+96

I have logs which shows lapse in seconds , they are several other logs along with this , i want to extract if logs pattern contains lapse and if lapse is greater than 100s ,and then print "xyz@admin-client-for-stag-21" who is the user who did this change ,may be extract only

Spoiler

xyz

user

Any help ?

Thanks,

[vinodarokiya]

Thanks a lot

[richgalloway · Accepted solution]

See if this helps.

... | rex "pid \d+ (?<user>\S+@\S+)"
| rex "lapse (?<lapse>\d+\.?\d+)"
| where lapse > 100
| table user lapse

[vinodarokiya]

May I please know how to extract one more table with all data that s there inside single quotes like :

'user-sizes //ddc/...'

After getting username , lapse ,how do we even print data that s within single quotes @richgalloway 

[richgalloway]

The process is very similar

... | rex "'(?<field1>[^\/]+)\/(?<field2>[^\/]*)\/(?<field3>[^\/]+)\/(?<field4>[^']+)'"
...

[vinodarokiya]

Thank you!