Splunk Search

Rex field extraction

michaeler
Communicator

I am trying to determine the average time for a set of issues to get resolved. I already created a field named "Duration" that extracts the time periods, the issue is that they're labeled in different time formats, with some combination of Day Hour Minute (ex. 4d 7h 20m, 1d 13m, 7h 43m, 5h, 25m).

Duration is a rex created field which pulls the info from a string that looks something like this:

issue="D830 System Down - 1930E 13 Jan - 2240 14 Jan (1d 3h 10m) - MU3892"

Here is part of the search:

index=main ...................
.
.
| rex field=issue ".*\((?P<Duration>\d[^\)]+"
| rex field=Duration "((?P<Days>\d{0,2})d\s)?((?P<Hours>\d{0,2})h\s)?(?P<Mins>\d{0,2})m"
| eval Days=tonumber(Days)
eval Hours=tonumber(Hours)
eval Mins=tonumber(Mins)
| eval MTTR=((Days*1440)+(Hours*60)+(Mins))/60
| table Duration Days Hours Mins MTTR

Two combinations work successfully - 1d 12m and 43m
Anything that includes the Hours field breaks the rex:
- 1d 10h 20m and 20h 10m only pulls Mins
- 5h doesn't work at all

I ran it in regex101 and it should work for all. What is wrong with my "rex field=Duration " line?

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You need to allow for there not being a space after h (and d for that matter) and for minutes to be optional

((?P<Days>\d{0,2})d\s*)?((?P<Hours>\d{0,2})h\s*)?((?P<Mins>\d{0,2})m)?

https://regex101.com/r/nLGQRT/1

View solution in original post

michaeler
Communicator

Update: I altered the rex and am now extracting all combinations except ones that only include Hours (ex 5h, 19h). 3d 7h 20m and 7d 20m are not successful.

Here is the update:

rex field=Duration "((?P<Days>\d{0,2})d\s)?((?P<Hours>\d{0,2})h\s)?((?P<Mins>\d{0,2})m)?"

Would it be easier just to do a separate rex to pull times that only include h?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have probably already worked out that you had not included the "*" after the "\s" for both days and hours.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to allow for there not being a space after h (and d for that matter) and for minutes to be optional

((?P<Days>\d{0,2})d\s*)?((?P<Hours>\d{0,2})h\s*)?((?P<Mins>\d{0,2})m)?

https://regex101.com/r/nLGQRT/1

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...