regex to extract part of the variable

[damucka]

Hello,

I need help with regex. I have the following string under the Tracefile variable in my search:

    /usr/sap/BWP/HDB02/ls5926/trace/DB_BWP/indexserver_ls5926.30240.crashdump.20181108-093323.134243.trc

My search looks as follows:

| metadata type=sources index=mlbso 
| rename totalCount as "Log Entries" source as "Tracefile" firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" 
| fieldformat "Log Entries"=tostring('Log Entries', "commas") 
| fieldformat "First Event"=strftime('First Event', "%c") 
| fieldformat "Last Event"=strftime('Last Event', "%c") 
| fieldformat "Last Update"=strftime('Last Update', "%c") 
| search Tracefile=CASE("*BWP*crashdump*") AND Tracefile!="/usr/sap/trans*" 
| sort - "Last Update" 
| head 1

Which basically gives back the Tracefile above as an output. So far so good.
Now, I would like to calculate the elapsed time since the last crash, which would be basically something like:

now() - 20181108-093323

How would I extract the "20181108-093323" from the Tracefile variable, convert it to the datetime, make a time delta and output it in the reasonable form of dd:hh:mm:ss?

Kind Regards,
Kamil

[harsmarvania57 · Accepted solution]

Hi @damucka,

Please try below search, in below search if you do not want to convert diff seconds to days, hours, minutes then remove | eval crashtime=tostring(diff, "duration") from below query

| metadata type=sources index=mlbso 
 | rename totalCount as "Log Entries" source as "Tracefile" firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" 
 | fieldformat "Log Entries"=tostring('Log Entries', "commas") 
 | fieldformat "First Event"=strftime('First Event', "%c") 
 | fieldformat "Last Event"=strftime('Last Event', "%c") 
 | fieldformat "Last Update"=strftime('Last Update', "%c") 
 | search Tracefile=CASE("*BWP*crashdump*") AND Tracefile!="/usr/sap/trans*" 
| rex field=Tracefile "crashdump\.(?<crash_time>\d+\-\d+)\."
| eval crash_time_epoch=strptime(crash_time, "%Y%m%d-%H%M%S")
| eval diff = now() - crash_time_epoch
| eval crashtime=tostring(diff, "duration")
| sort - "Last Update"
| head 1

Below is run anywhere search which is generating correct result.

| makeresults
| eval Tracefile="/usr/sap/BWP/HDB02/ls5926/trace/DB_BWP/indexserver_ls5926.30240.crashdump.20181108-093323.134243.trc"
| rex field=Tracefile "crashdump\.(?<crash_time>\d+\-\d+)\."
| eval crash_time_epoch=strptime(crash_time, "%Y%m%d-%H%M%S")
| eval diff = now() - crash_time_epoch
| eval crashtime=tostring(diff, "duration")