×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Pavankt
Loves-to-Learn
Member since: ‎11-05-2023
‎11-06-2023
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎11-05-2023
View All

arthematic operations are not working on extracted...

by in Dashboards & Visualizations
‎11-05-2023 11:30 PM
‎11-05-2023 11:30 PM
my json file contains total 2 stages as below. per_stage_info_vendor_data: [ [-]      { [-]        Stage: stage1        WallClockTime: 0h:30m:23s      }      { [-]        Stage: stage2         WallClockTime: 0h:52m:36s      }       ]   with following regular expression we are able to get the hours mins and seconds. rex field=per_stage_info_vendor_data{}.WallClockTime max_match=0 "((?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s)" But when i tried |eval  stagetime=hours*3600+minutes*60+seconds  it's not working, when i checked further any of the arithmetic  operation on these three fields(hours,minutes and seconds).   do i need to convert these fields to any other format. ... View more
Labels

Re: exatracing seconds from the string "2h:30m:20s...

by in Dashboards & Visualizations
‎11-05-2023 07:26 AM
‎11-05-2023 07:26 AM
Thanks for the reply Actually my json file contains total 2 stages as below. per_stage_info_vendor_data: [ [-]      { [-]        Stage: stage1        WallClockTime: 0h:30m:23s      }      { [-]        Stage: stage2         WallClockTime: 0h:52m:36s      }       ]   with following regular expression we are able to get the hours mins and seconds. rex field=per_stage_info_vendor_data{}.WallClockTime max_match=0 "((?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s)" But when i tried |eval  stagetime=hours*3600+minutes*60+seconds  it's not working, when i checked further any of the arithmetic  operation on these three fields(hours,minutes and seconds).   do i need to convert these fields to any other format.           ... View more

exatracing seconds from the string "2h:30m:20s:

by in Dashboards & Visualizations
‎11-05-2023 02:38 AM
‎11-05-2023 02:38 AM
i have a splunk array  per_stage_data: [ [-]      { [-]        Stage: S1         TimeTaken: 0h:30m:23s      }      { [-]        Stage: S2         TimeTaken: 0h:52m:36s      }     ] i am implementing a splunk dashboard , in that i want to convert the per_stage_data{}.TimeTaken into seconds. i had tried multiple ways but it didn't worked. tried using the below solution  but it's not giving any output. rex field="_raw" "CallDuration: (?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" | eval CallDurationInSeconds = ((hours*60*60)+(minutes*60)+(seconds))   appreciate any inputs.   Thanks in advance.  ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎11-06-2023 02:18 PM