Splunk Search

How to get the value from the json file using regex?

anooshac
Communicator

Hi all,

I have a multiple json files. The format is like as below.

{
"ID": "123",
"TIME": "Jul 11, 2021, 08:55:54 AM",
"STATUS": "FAIL",
"DURATION": "4 hours, 32 minutes",
}

From these json files i want to use the DURATION field and convert the value into hours. After that i want to use these values of all the json files to plot a graph.

I have used regex to extract the value, but its not working. Below is the query that i have used.

| rex field=DURATION "(?<duration_hour>\d*)hours, ?(?<duration_minute>\d*)minutes"
| eval DURATION=duration_hour+(duration_minute)/60

can anyone please tell me what is mistake here?

Labels (2)
Tags (5)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Try this

| rex field=DURATION "(?<duration_hour>\d*)\shours, ?(?<duration_minute>\d*)\sminutes"
| eval DURATION=duration_hour+(duration_minute)/60

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Try this

| rex field=DURATION "(?<duration_hour>\d*)\shours, ?(?<duration_minute>\d*)\sminutes"
| eval DURATION=duration_hour+(duration_minute)/60
0 Karma

anooshac
Communicator

Thank you so much!! It is working properly.. Can you please explain that query?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Actually you did everything. I have just corrected your regular expressions

You missed space (\s) before hours and minutes

Happy Splukning

🙂 

0 Karma

anooshac
Communicator

yeah.. Got it! Thanks once again!!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...