Splunk Search

Query to retrieve the data from the logs

sushma7
Path Finder

Hi Team,

I have indexed system logs into the SPLUNK and it looks something like below:

[4/1/14 6:06:10:218 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.218 | | | | | | | Completed ftpHandler .doPost
[4/1/14 6:06:10:938 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.938 | | | | | | | In FTP recognize *****Reqtype:E****Filename:FDD_110001001_110001000_20140401_062210_20140401_3_201404010622421530_P.XCF

Now here, I want to retrieve the time when the "Completed ftpHandler .doPost" operation has been completed say 2014-04-01 06:06:10.218 as per our example above and the time when the "requesttype:E" operation has been completed say 2014-04-01 06:06:10.938 . Once I get these two time values then I should be able to calculate the difference between those two time period.

I need query to be written in such a manner. Is that possible?

Please help!

Regards,
Sushma.

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi sushma7,

something like this will bring you ad-hoc results:

YourBaseSearchHere 
| rex field="_raw" "(?=\s\|\s)(?<mydoPostTime>.+)(?<=\s(\|\s){7}Completed\sftpHandler\s\.doPost)" 
| rex field="_raw" "(?=\s\|\s)(?<mydoReqtypeTime>.+)(?<=\s(\|\s){7}In\sFTP\srecognize\s\*\*\*\*\*Reqtype:E\*\*\*\*)" 
| eval mydoPostTime_epoch=strptime(mydoPostTime,"%Y-%m-%d %H:%M:%S.%3Q") 
| eval mydoReqtypeTime_epoch=strptime(mydoReqtypeTime,"%Y-%m-%d %H:%M:%S.%3Q") 
| eval diff=mydoReqtypeTime_epoch-mydoPostTime_epoch 
| eval run_time=strftime(diff, "%H:%M:%S.%3Q")

You should setup this as field extraction so you will no longer need the rex commands.

hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi sushma7,

something like this will bring you ad-hoc results:

YourBaseSearchHere 
| rex field="_raw" "(?=\s\|\s)(?<mydoPostTime>.+)(?<=\s(\|\s){7}Completed\sftpHandler\s\.doPost)" 
| rex field="_raw" "(?=\s\|\s)(?<mydoReqtypeTime>.+)(?<=\s(\|\s){7}In\sFTP\srecognize\s\*\*\*\*\*Reqtype:E\*\*\*\*)" 
| eval mydoPostTime_epoch=strptime(mydoPostTime,"%Y-%m-%d %H:%M:%S.%3Q") 
| eval mydoReqtypeTime_epoch=strptime(mydoReqtypeTime,"%Y-%m-%d %H:%M:%S.%3Q") 
| eval diff=mydoReqtypeTime_epoch-mydoPostTime_epoch 
| eval run_time=strftime(diff, "%H:%M:%S.%3Q")

You should setup this as field extraction so you will no longer need the rex commands.

hope this helps ...

cheers, MuS

MuS
Legend

follow the link to the docs and the commands look good, just cross-checked

0 Karma

sushma7
Path Finder

How to use filed extraction rather than this rex commands?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...