topic extract field values in Dashboards & Visualizations

extract field values

msarkaus — Thu, 27 Feb 2025 19:04:35 GMT

Hello, I’m trying to only pull a spefic value from the msgTxt log. In the log below, the example is 2024. This value does change and could be one digit or up to 6 digits.

msgTxt = xxiskServicxxxapper - MxxeNext completed in 2024 ms. (request details: environment: Production | desired services: BusixxxsOwnexxxerritory | property type: Commercial | address: x RxxxDANx DR , xxxSHFIELD , xx 02xx0)

Below is the search I'm trying to use but its not working. Any help would be apreseated.

| eval msgTxt=" msgTxt: xxiskServicxxxapper - MxxeNext completed in 2024 ms. (request details: environment: Production | desired services: BusixxxsOwnexxxerritory*"
| rex "in=(?<in>\w+)."
| stats count by in

Re: extract field values

richgalloway — Thu, 27 Feb 2025 19:30:04 GMT

You're very close. Use \d (digit) in place of \w (word). Also, remove the '=' since there is no such character in the data.

| rex "in (?<in>\d+)"

Re: extract field values

msarkaus — Thu, 27 Feb 2025 19:34:34 GMT

Thank you

Re: extract field values

msarkaus — Tue, 04 Mar 2025 20:10:00 GMT

Sorry to be a bother, but what if there is a special char like = involved. I can't add the equal sign into my search query.

| eval msxxxt="*Action=GexxxxdledxxxxReport Duration=853*"
| rex "Duration (<?Duration>\d+)"
| timechart span=1h avg(Duration) AS avg_response by msxxxt

Thanks again for your help

Re: extract field values

richgalloway — Wed, 05 Mar 2025 01:02:05 GMT

The search command cannot search for '*'. The '=' character also is a challenge. You can, however, use regex to filter on these and other "special" characters.

| eval msxxxt="*Action=GexxxxdledxxxxReport Duration=853*" | regex "=" | rex "Duration (<?Duration>\d+)" | timechart span=1h avg(Duration) AS avg_response by msxxxt