Splunk regex matching for spring batch job times

user_1050640 0
Viewed 54

I'm trying to write a regular expression to capture the job run times of a Spring Batch job but I am stuck. Below are a few examples of what the log for a spring batch job runtime could look like. I have also put down what I currently have but the regex I have is confused when the job may run for over a minute. Any help here would be appreciated. My end result i'm trying to get to is a panel in splunk that shows the average daily run time.

Also before anyone asks i have been using regex101 for the past couple days and still not getting good results. Figured stack community might be able to help!

Possible Job times formats:

709ms
59s709ms
1m59s709ms

My current query only works for the first two examples above. Also is there a way to get an expression where i don't need to put a number at the end of my capture group?

Current Regex Query:

(?<jobRunTimeMs1>\d*)ms?|(?<jobRunTimeS2>\d*)s?(?<jobRunTimeMs2>\d*)ms?|(?<jobRunTimeM3>\d*)m?(?<jobRunTimeS3>\d*)s?(?<jobRunTimeMs3>\d*)ms?
splunk regex
2 Answers

If you pull the extra question marks from your regex, it runs as expected:

| rex field=_raw "(?<jobRunTimeMs1>\d+)ms|(?<jobRunTimeS2>\d+)s(?<jobRunTimeMs2>\d+)ms|(?<jobRunTimeM3>\d+)m(?<jobRunTimeS3>\d+)s(?<jobRunTimeMs3>\d+)ms"

Append a couple coalesces to bring them together, and drop the extraneous fields with fields:

| eval ms=coalesce(ms1,ms2,ms3), s=coalesce(s2,s3), m=m3
| fields - ms1 ms2 ms3 s2 s3 m3

However, I generally prefer to run sequential individual extractions (especially when the format may vary, as yours does) for readability (and not needing to do the coalesce step afterwards):

| rex field=_raw "(?<minutes>\d+)m\d"
| rex field=_raw "m?(?<seconds>\d+)s"
| rex field=_raw "s?(?<milliseconds>\d+)ms"
warren_44180

I think you need

(?:(?<jobRunTimeM3>\d+)m)?(?:(?<jobRunTimeS2>\d+)s)?(?<jobRunTimeMs2>\d+)ms?

See the regex demo. Here, the regex matches

  • (?:(?<jobRunTimeM3>\d+)m)? - an optional one or more digits captured into jobRunTimeM3 group and then an m char
  • (?:(?<jobRunTimeS2>\d+)s)? - one or more digits captured into jobRunTimeS2 group and then an s char
  • (?<jobRunTimeMs2>\d+) - captures one or more digits into jobRunTimeMs2 group and then matches
  • ms? - m or ms.
user_38329700
Related