Splunk Search

Query to retrieve the data from the logs

sushma7
Path Finder

Hi Team,

I have indexed system logs into the SPLUNK and it looks something like below:

[4/1/14 6:06:10:218 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.218 | | | | | | | Completed ftpHandler .doPost
[4/1/14 6:06:10:938 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.938 | | | | | | | In FTP recognize *****Reqtype:E****Filename:FDD_110001001_110001000_20140401_062210_20140401_3_201404010622421530_P.XCF

Now here, I want to retrieve the time when the "Completed ftpHandler .doPost" operation has been completed say 2014-04-01 06:06:10.218 as per our example above and the time when the "requesttype:E" operation has been completed say 2014-04-01 06:06:10.938 . Once I get these two time values then I should be able to calculate the difference between those two time period.

I need query to be written in such a manner. Is that possible?

Please help!

Regards,
Sushma.

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi sushma7,

something like this will bring you ad-hoc results:

YourBaseSearchHere 
| rex field="_raw" "(?=\s\|\s)(?<mydoPostTime>.+)(?<=\s(\|\s){7}Completed\sftpHandler\s\.doPost)" 
| rex field="_raw" "(?=\s\|\s)(?<mydoReqtypeTime>.+)(?<=\s(\|\s){7}In\sFTP\srecognize\s\*\*\*\*\*Reqtype:E\*\*\*\*)" 
| eval mydoPostTime_epoch=strptime(mydoPostTime,"%Y-%m-%d %H:%M:%S.%3Q") 
| eval mydoReqtypeTime_epoch=strptime(mydoReqtypeTime,"%Y-%m-%d %H:%M:%S.%3Q") 
| eval diff=mydoReqtypeTime_epoch-mydoPostTime_epoch 
| eval run_time=strftime(diff, "%H:%M:%S.%3Q")

You should setup this as field extraction so you will no longer need the rex commands.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi sushma7,

something like this will bring you ad-hoc results:

YourBaseSearchHere 
| rex field="_raw" "(?=\s\|\s)(?<mydoPostTime>.+)(?<=\s(\|\s){7}Completed\sftpHandler\s\.doPost)" 
| rex field="_raw" "(?=\s\|\s)(?<mydoReqtypeTime>.+)(?<=\s(\|\s){7}In\sFTP\srecognize\s\*\*\*\*\*Reqtype:E\*\*\*\*)" 
| eval mydoPostTime_epoch=strptime(mydoPostTime,"%Y-%m-%d %H:%M:%S.%3Q") 
| eval mydoReqtypeTime_epoch=strptime(mydoReqtypeTime,"%Y-%m-%d %H:%M:%S.%3Q") 
| eval diff=mydoReqtypeTime_epoch-mydoPostTime_epoch 
| eval run_time=strftime(diff, "%H:%M:%S.%3Q")

You should setup this as field extraction so you will no longer need the rex commands.

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

follow the link to the docs and the commands look good, just cross-checked

0 Karma

sushma7
Path Finder

How to use filed extraction rather than this rex commands?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...