topic Re: How do I use rex command here ? in Splunk Dev

How do I use rex command here ?

harshal94 — Tue, 29 Sep 2020 19:47:36 GMT

Following is the sample event:

2018-05-31 13:05:32.673, SQL_ID="5y1v8tznxf4t1", DBID="3602297620", SQL_TEXT="SELECT "MBLNR","MJAHR","BWART","MATNR","WERKS","LGORT","WAERS","DMBTR","MENGE","SGTXT","GRUND","BUDAT_MKPF","USNAM_MKPF" FROM "MSEG" WHERE "MANDT"=:A0 AND "BUDAT_MKPF" BETWEEN :A1 AND :A2 AND "WERKS"=:A3 AND "BWART" BETWEEN :A4 AND :A5", ELAPSED_TIME="2876.465675", TOTAL_TIME="5752.93135", EXEC="2"

Required Field is in bold.
I want ELAPSED_TIME as field and its value.

Re: How do I use rex command here ?

FrankVl — Thu, 31 May 2018 12:15:42 GMT

This should do the trick:

| rex "ELAPSED_TIME=\"(?<ELAPSED_TIME>[^\"]+)\"

Re: How do I use rex command here ?

poete — Thu, 31 May 2018 12:34:16 GMT

Please try this:

   | makeresults 
    | eval data="2018-05-31 13:05:32.673, SQL_ID=\"5y1v8tznxf4t1\", DBID=\"3602297620\", SQL_TEXT=\"SELECT \"MBLNR\",\"MJAHR\",\"BWART\",\"MATNR\",\"WERKS\",\"LGORT\",\"WAERS\",\"DMBTR\",\"MENGE\",\"SGTXT\",\"GRUND\",\"BUDAT_MKPF\",\"USNAM_MKPF\" FROM \"MSEG\" WHERE \"MANDT\"=:A0 AND \"BUDAT_MKPF\" BETWEEN :A1 AND :A2 AND \"WERKS\"=:A3 AND \"BWART\" BETWEEN :A4 AND :A5\", ELAPSED_TIME=\"2876.465675\", TOTAL_TIME=\"5752.93135\", EXEC=\"2"
    | rex field=data ", ELAPSED_TIME=\"(?<numValue>\d+\.\d+)\""
    | table data,numValue