Hi,
A job needs to be completed by 04:45 AM,
Can some one help me to extract time from the logs, compare 04:45 AM and send an alert.
Kindly help
Mkay... assuming the field OSTIME
is already extracted, do something like this:
... | rex field=OSTIME "(?<OS_hour>\d+):(?<OS_minute>\d+)" | eval too_late = if(OS_hour * 60 + OS_minute > 285, "yes", "no")
I'm not treating it as a date because you're not interested in the date, or the entire timestamp. You're just looking to compare the HH:MM
portion to see if more than 285 minutes have elapsed since midnight. An alternative, approach using the entire timestamp would be this:
... | eval OSTIME_epoch = strptime(OSTIME, "%m/%d/%Y %H:%M:%S") | eval too_late = if((OSTIME_epoch - relative_time(OSTIME_epoch, "@d")) > (285*60), "yes", "no")
However, this may fail when combined with daylight savings changes... more or less time will have elapsed on those two days when it is 04:45.
Mkay... assuming the field OSTIME
is already extracted, do something like this:
... | rex field=OSTIME "(?<OS_hour>\d+):(?<OS_minute>\d+)" | eval too_late = if(OS_hour * 60 + OS_minute > 285, "yes", "no")
I'm not treating it as a date because you're not interested in the date, or the entire timestamp. You're just looking to compare the HH:MM
portion to see if more than 285 minutes have elapsed since midnight. An alternative, approach using the entire timestamp would be this:
... | eval OSTIME_epoch = strptime(OSTIME, "%m/%d/%Y %H:%M:%S") | eval too_late = if((OSTIME_epoch - relative_time(OSTIME_epoch, "@d")) > (285*60), "yes", "no")
However, this may fail when combined with daylight savings changes... more or less time will have elapsed on those two days when it is 04:45.
It'd help if we knew what the time in your logs looked like.
Hi Martin,
Thanks for your reply.
In the logs, we have OSTIME field. From OSTIME, we need to extract %H:%M.
Everyday this value need to compare with 04:45, to check the job is runningeven after 04:45 AM
The time format in logs looks like below
OSTIME="11/09/2015 06:05:00"