Splunk Search

Is it possible to parse daily log file to report the time between OffHook and OnHook event

New Member

Did a little bit of searching, but didn't really find what I needed, but I also don't know if I'm even searching the best way/terms/ keywords.

I'm hoping Splunk can parse daily log file (.log) and look for the following lines:

05:49:15.416 ( 7528:11056) U-PE: 20000018 Hook:  1 (OffHook)
00:26:41.618 ( 7528: 7820) U-PE: 2000017A State: 12 (Established)
01:22:02.283 ( 7528:11056) U-PE: 20000156 Hook:  0 (OnHook)

The first part is just standard time in the %T.%f style formating.
The second part is always 5 numbers or 4 with a leading space a colon and 5 more numbers or 4 with a leading space.
The U-PE: is the event and the 8 alphanumeric ID that comes after that is uniquely bound to a user.

What I hope Splunk can do, is find every time there is a U-PE: OffHook event that does NOT have an Established U-PE: before the U-PE OnHook event, and report the time between the OffHook and OnHook event.

As for the 8 character User ID, there are about two or three hundred, but they are all unique.

0 Karma


Yes, this is possible. I copy/pasted your small snippet of log and set up an ingestion into Splunk and extracted the fields you had identified (the field extraction might need some tweaking depending on your usage).

Props.conf is as follows:

LINE_BREAKER = ([\r\n]+)
category = Custom
pulldown_type = true
EXTRACT-transaction_id,user_id,state = ^[^\(\n]*\((?P<transaction_id>[^\)]+)[^:\n]*:\s+(?P<user_id>\w+)[^\(\n]*\((?P<state>\w+)

One you have the data extraction you should be able to find the duration of calls with the transaction command. It will look something like:

your_search | transaction state startswith="OffHook" endswith="OnHook"

Hope that helps!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...