Rex field extraction

[michaeler]

I am trying to determine the average time for a set of issues to get resolved. I already created a field named "Duration" that extracts the time periods, the issue is that they're labeled in different time formats, with some combination of Day Hour Minute (ex. 4d 7h 20m, 1d 13m, 7h 43m, 5h, 25m).

Duration is a rex created field which pulls the info from a string that looks something like this:

issue="D830 System Down - 1930E 13 Jan - 2240 14 Jan (1d 3h 10m) - MU3892"

Here is part of the search:

index=main ...................
.
.
| rex field=issue ".*\((?P<Duration>\d[^\)]+"
| rex field=Duration "((?P<Days>\d{0,2})d\s)?((?P<Hours>\d{0,2})h\s)?(?P<Mins>\d{0,2})m"
| eval Days=tonumber(Days)
| eval Hours=tonumber(Hours)
| eval Mins=tonumber(Mins)
| eval MTTR=((Days*1440)+(Hours*60)+(Mins))/60
| table Duration Days Hours Mins MTTR

Two combinations work successfully - 1d 12m and 43m
Anything that includes the Hours field breaks the rex:
- 1d 10h 20m and 20h 10m only pulls Mins
- 5h doesn't work at all

I ran it in regex101 and it should work for all. What is wrong with my "rex field=Duration " line?

[michaeler]

Update: I altered the rex and am now extracting all combinations except ones that only include Hours (ex 5h, 19h). 3d 7h 20m and 7d 20m are not successful.

Here is the update:

rex field=Duration "((?P<Days>\d{0,2})d\s)?((?P<Hours>\d{0,2})h\s)?((?P<Mins>\d{0,2})m)?"

Would it be easier just to do a separate rex to pull times that only include h?

[ITWhisperer]

You have probably already worked out that you had not included the "*" after the "\s" for both days and hours.

[ITWhisperer · Accepted solution]

You need to allow for there not being a space after h (and d for that matter) and for minutes to be optional

((?P<Days>\d{0,2})d\s*)?((?P<Hours>\d{0,2})h\s*)?((?P<Mins>\d{0,2})m)?

https://regex101.com/r/nLGQRT/1