Using Splunk rex to extract String from logs

user_7585812 0
Viewed 719

From splunk logs,how can I get a count of all those methods whose Time taken is > 10ms?
Splunk logs which look some thing like this :

c.s.m.c.advice.ExecutionTimeAdvice : <> relationId = aa12 | Method Name = methodA() Time taken is = 0ms

c.s.m.c.advice.ExecutionTimeAdvice : <> relationId = ab12 | Method Name = methodA(). Time taken is = 15ms

c.s.m.c.advice.ExecutionTimeAdvice : <> relationId = ab12 | Method Name = methodB(). Time taken is = 1ms

splunk
1 Answers

This would be the general idea:

| rex field=_raw "Name = (?<methodName>\w+)\("
| rex field=_raw "s = (?<duration>\d+)\D"
| where duration > 10
| stats count by methodName

Within your search, you will need to

  1. Create a rex field to grab the method name
  2. Create a rex field to grab the duration in milliseconds
  3. Use the where command to filter the results to where your new "duration" field > 10ms
  4. Use the stats command with count by to count the current results, binning by your new "methodName" field

If this is not exactly correct for your logs, it should at least get you very close.

user_113539650
Related