Splunk Search

Regex for getting slow query logs from mongodb

New Member

I am new to SPL. I want to get all mongo queries from my mongo logs which take more than 5 ms to execute. My mongo logs are like this:

Thu Jun 13 15:47:25 [conn15] update mydb.mycollection query: { cId: 2441, tId: 545, uId: 478, status: 1, type: "0",   dDt: { $lte: new Date(1371138445623) } } update: { $set: { status: 3 } } nscanned:120 nupdated:0 keyUpdates:0 locks(micros) w:10602 10ms

The last entry here (10 ms) is the time in milliseconds. How can I filter these queries?

Tags (3)
0 Karma
1 Solution

Contributor

Something like this should work for you :

...|rex field=_raw"(?<LastEntryTime>\d*)ms$" |search LastEntryTime>5

View solution in original post

Splunk Employee
Splunk Employee

JSapienza provided a nice working regex below. I would recommend checking if Splunk will automatically extract that as well. You might already have this in field.

Contributor

Something like this should work for you :

...|rex field=_raw"(?<LastEntryTime>\d*)ms$" |search LastEntryTime>5

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!