简体繁体中英

Using Splunk rex to extract String from logs

原文 2021-10-26 18:02:02 4 1 splunk

From splunk logs,how can I get a count of all those methods whose Time taken is > 10ms?
Splunk logs which look some thing like this :

csmcadvice.ExecutionTimeAdvice : <> relationId = aa12 | Method Name = methodA() Time taken is = 0ms

csmcadvice.ExecutionTimeAdvice : <> relationId = ab12 | Method Name = methodA(). Time taken is = 15ms

csmcadvice.ExecutionTimeAdvice : <> relationId = ab12 | Method Name = methodB(). Time taken is = 1ms

1 answers

This would be the general idea:

| rex field=_raw "Method Name = (?<methodName>\w*)\(\)"
| rex field=_raw "Time taken is = (?<duration>\d*)ms"
| where duration > 10
| stats count by methodName

Within your search, you will need to

Create a rex field to grab the method name
Create a rex field to grab the duration in milliseconds
Use the where command to filter the results to where your new "duration" field > 10ms
Use the stats command with count by to count the current results, binning by your new "methodName" field

If this is not exactly correct for your logs, it should at least get you very close.

Using Splunk rex command to extract a field between 2 words

Splunk: how to extract fields using regular expressions? like rex in splunk search

Splunk Rex: Extracting fields of a string to a value

Using a group by or something similar using Splunk rex

How to use REX command to extract multiple fields in splunk?

How to extract fields from JSON string in Splunk

Splunk Rex Expression

Table from logs in Splunk

Extracting data using rex in splunk adds slash to the data

Using Named Group Capture With rex In a Splunk Dashboard Query?

暂无

暂无

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

Related Question Using Splunk rex command to extract a field between 2 words Splunk: how to extract fields using regular expressions? like rex in splunk search Splunk Rex: Extracting fields of a string to a value Using a group by or something similar using Splunk rex How to use REX command to extract multiple fields in splunk? How to extract fields from JSON string in Splunk Splunk Rex Expression Table from logs in Splunk Extracting data using rex in splunk adds slash to the data Using Named Group Capture With rex In a Splunk Dashboard Query?

Related Tags

粤ICP备18138465号 © 2020-2024 STACKOOM.COM