topic Re: Help extracting a value from this log? in Splunk Search

Help extracting a value from this log?

rajgowd1 — Tue, 29 Sep 2020 16:39:39 GMT

Hi,
can someone help me to exact "536 MiliSeconds" from below is log

6>2017-11-02T05:55:12Z d065d14b-3bcd-481c-512a-bfd42485714d doppler[15]: {"cf_app_id":"d5632633-2365-4b73-83ba-27d0xxxxxxxxx","cf_app_name":"xln-sm-d-MarketingExtOffer-xxxx","cf_ignored_app":false,"cf_org_id":"xxxxxxxx-6ecd-4af6-a32d-xxxxxxxxxx","cf_org_name":"CROSS_xxx-NAM","cf_origin":"xxxxxxxxx","cf_space_id":"xxxxxxxxxx-aa31-414a-88bc-xxxxxxxxx","cf_space_name":"SALES_MKTG-SIT3","deployment":"cf","event_type":"LogMessage","ip":"153.40.210.253","job":"diego_cell-partition-xxxxxxxxxx","job_index":"71","level":"info","message_type":"OUT","msg":" INFO [nio-8080-exec-9] c.c.e.i.u.ExtOfferConnectionUtil c.c.e.i.u.ExtOfferLogUtil.logInfo(ExtOfferLogUtil.java:27) - POST|/private/v1/offer/rocketFuel|84f85631-114f-41f5-9824-xxxxxxxxxx|372aae13-728c-4002-87f5-xxxxxxxxxxx|||||||||||ExtOfferConnectionUtil- Time taken for ExtOfferConnectionUtil.sendRF is : 536 MiliSeconds","origin":"rep","source_instance":"0","source_type":"APP","time":"2017-11-02T05:55:12Z","timestamp":1509602112630605039

Re: Help extracting a value from this log?

niketn — Wed, 08 Nov 2017 19:38:50 GMT

@rajgowd1, try the following rex command:

<YourBaseSearch>
| rex "Time taken for ExtOfferConnectionUtil\.sendRF is : (?<time>[^\"]+)\""

Re: Help extracting a value from this log?

rajgowd1 — Wed, 08 Nov 2017 22:37:59 GMT

Hi Thank you, i just want the number.can you help on this
like

536

Re: Help extracting a value from this log?

niketn — Thu, 09 Nov 2017 02:31:28 GMT

@rajgowd1, please try the following then, it breaks field extraction the moment it encounters a space.

<YourBaseSearch>
 | rex "Time taken for ExtOfferConnectionUtil\.sendRF is : (?<time>[^\s]+)\s"

You should try to use https://regex101.com/ for creating and testing regular expression with your sample data.