Splunk Search

Need to extract elapsed time

vipulg83
New Member

hi,

I have a query with the below mentioned resultset

logger: com.optum.bh.benefit.plan.api.BhBenefitPlansResource
message: bhben-plan-api:bHPlanView(), env=prod packageId = 1438939 timeUsed(ms) = 19
properties: { [+]
}
severity: DEBUG
thread: http-nio-8080-exec-5
}
Show as raw text
host = hec-splunk.optum.commessage = bhben-plan-api:bHPlanView(), env=prod packageId = 1438939 timeUsed(ms) = 19source = bhwebservice.logsourcetype = cba_shared_components:scwebservice:error_log

Need to extract timeUsed(ms) field so that I can build a table for the elapsed time for the requests

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should do it.

... | rex "timeUsed\(ms) = (?<timeUsed>\d+)"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should do it.

... | rex "timeUsed\(ms) = (?<timeUsed>\d+)"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

vipulg83
New Member

Error in 'rex' command: Encountered the following error while compiling the regex 'timeUsed(ms) = (?\d+)': Regex: unmatched closing parenthesis

0 Karma

vipulg83
New Member

was able to build a dashboard guys, thanks for your help

rex "timeUsed(ms) = (?<timeUsed>\d+)"|table timeUsed | eval timeUsedBucket=case(timeUsed<=100,"0-100ms",timeUsed<=200,"101-200ms",timeUsed<=500,"201-500ms",timeUsed<=1000,"501-1000ms",timeUsed<=5000,"1001-5000ms",1==1,"above 5000ms")| stats count by timeUsedBucket

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That error message usually means there's a missing backslash \\.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

vipulg83
New Member

Done, thanks

index=cba_shared_components timeUsed(ms)| rex "timeUsed(ms) = (?\d+)"|table timeUsed

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use backticks to keep the system from eating your code.
If your problem is resolved then please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

to4kawa
SplunkTrust
SplunkTrust

you fix it

0 Karma

vipulg83
New Member

Updated it a bit

rex "timeUsed(ms) = (?\d+)"

0 Karma

vipulg83
New Member

Done, thanks

index=cba_shared_components timeUsed(ms)| rex "timeUsed(ms) = (?\d+)"|table timeUsed

0 Karma

vipulg83
New Member

working on that

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.