Splunk Search

calculating time of free form value in log message

moj0002
New Member

Is there a way I can create a bar chart with the response time extracted from these free form log messages that corellate on the ID. There will always only be a pair (starting and finished) I would like the result to be timestamp and the duration (in this case)

2014.02.18-19:05:07:687 minus 2014.02.18-19:05:07:583 = 104 milliseconds displayed in a barchart.

Not sure if this is possible

19:05:07,583 INFO starting to wait for message with ID [ID:ABC2020123} at [2014.02.18-19:05:07:583]

19:05:10,216 INFO starting to wait for message with ID [ID:XYZ2020456} at [2014.02.18-19:05:10:216]

19:05:07,687 INFO finished waiting for message with ID [ID:ABC2020123} at [2014.02.18-19:05:07:687]

Tags (1)
0 Karma

somesoni2
Revered Legend

Try this

index=main sourcetype="mytran" | rex "^(?:[^ ]* ){2}(?P<action>[^ ]+)" | rex "\[ID:(?<ID>[^\}]+)" | transaction ID startswith=action=starting endswith=action=finished  | table _time, ID, duration

duration is in seconds.

0 Karma

HiroshiSatoh
Champion

I tried to extract the field(ID, time0).

・・・・・| rex field=_raw "[^\[\n]*\[\w+:(?P<ID>[^\}]+)[^\[\n]*\[(?P<time0>[^\]]+)" | transaction fields=ID|eval time1=strptime(mvindex(time0,0),"%Y.%m.%d-%H:%M:%S:%3N")|eval time2=strptime(mvindex(time0,1),"%Y.%m.%d-%H:%M:%S:%3N")|eval time3=time2-time1|table ID,time0,time1,time2,time3

alt text

0 Karma

moj0002
New Member

thank you that worked

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...