CODEWITHSUNDEEP
splunk
k.jones
k.jones

Reputation: 29

Using Splunk rex to extract String from logs

From splunk logs,how can I get a count of all those methods whose Time taken is > 10ms?
Splunk logs which look some thing like this :

c.s.m.c.advice.ExecutionTimeAdvice : <> relationId = aa12 | Method Name = methodA() Time taken is = 0ms

c.s.m.c.advice.ExecutionTimeAdvice : <> relationId = ab12 | Method Name = methodA(). Time taken is = 15ms

c.s.m.c.advice.ExecutionTimeAdvice : <> relationId = ab12 | Method Name = methodB(). Time taken is = 1ms

Upvotes: 2

Views: 3864

Answers (1)

josephsturm
josephsturm

Reputation: 323

This would be the general idea:

| rex field=_raw "Name = (?<methodName>\w+)\("
| rex field=_raw "s = (?<duration>\d+)\D"
| where duration > 10
| stats count by methodName

Within your search, you will need to

  1. Create a rex field to grab the method name
  2. Create a rex field to grab the duration in milliseconds
  3. Use the where command to filter the results to where your new "duration" field > 10ms
  4. Use the stats command with count by to count the current results, binning by your new "methodName" field

If this is not exactly correct for your logs, it should at least get you very close.

Upvotes: 2

Related Questions