I have a field 'vpn_duration' which is taken from the 'Duration:' value in an ASA syslog disconnect message.
The message looks like this:
May 26 15:15:56 cvpn.X.net May 26 2010 14:58:24: %ASA-4-113019: Group = XVPN, Username = userA, IP = 1.2.3.4, Session disconnected. Session Type: IPsec, Duration: 5h:06m:18s, Bytes xmt: 24875, Bytes rcv: 33036, Reason: Lost Service
I would like to take the value I get (5h:06m:18s) and convert it into minutes. So, in this case, my result would be 306.
How can I get this done?
You can use something like the following search:
your search terms | rex "Duration: (?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" | eval duration_minutes = ((hours*60)+minutes+(seconds/60))
I came up with almost the same thing as ftk, except my ASA has durations > 1d in the logs..
| rex field="_raw" "Duration: (?<dur_day>[0-9]+)?d? *(?<dur_hour>[0-9]+)h?:(?<dur_min>[0-9]+)m?"
| eval connduration=(if(dur_day=="",0,dur_day)*1440)+(dur_hour * 60)+dur_min
You can use something like the following search:
your search terms | rex "Duration: (?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" | eval duration_minutes = ((hours*60)+minutes+(seconds/60))