Query to retrieve the data from the logs

[sushma7]

Hi Team,

I have indexed system logs into the SPLUNK and it looks something like below:

[4/1/14 6:06:10:218 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.218 | | | | | | | Completed ftpHandler .doPost
[4/1/14 6:06:10:938 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.938 | | | | | | | In FTP recognize *****Reqtype:E****Filename:FDD_110001001_110001000_20140401_062210_20140401_3_201404010622421530_P.XCF

Now here, I want to retrieve the time when the "Completed ftpHandler .doPost" operation has been completed say 2014-04-01 06:06:10.218 as per our example above and the time when the "requesttype:E" operation has been completed say 2014-04-01 06:06:10.938 . Once I get these two time values then I should be able to calculate the difference between those two time period.

I need query to be written in such a manner. Is that possible?

Please help!

Regards,
Sushma.

[MuS · Accepted solution]

Hi sushma7,

something like this will bring you ad-hoc results:

YourBaseSearchHere 
| rex field="_raw" "(?=\s\|\s)(?<mydoPostTime>.+)(?<=\s(\|\s){7}Completed\sftpHandler\s\.doPost)" 
| rex field="_raw" "(?=\s\|\s)(?<mydoReqtypeTime>.+)(?<=\s(\|\s){7}In\sFTP\srecognize\s\*\*\*\*\*Reqtype:E\*\*\*\*)" 
| eval mydoPostTime_epoch=strptime(mydoPostTime,"%Y-%m-%d %H:%M:%S.%3Q") 
| eval mydoReqtypeTime_epoch=strptime(mydoReqtypeTime,"%Y-%m-%d %H:%M:%S.%3Q") 
| eval diff=mydoReqtypeTime_epoch-mydoPostTime_epoch 
| eval run_time=strftime(diff, "%H:%M:%S.%3Q")

You should setup this as field extraction so you will no longer need the rex commands.

hope this helps ...

cheers, MuS

[MuS]

follow the link to the docs and the commands look good, just cross-checked

[sushma7]

How to use filed extraction rather than this rex commands?