https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rex-for-search/m-p/393730#M114466 <P>I have the below log line:<BR /> Slow GraphQL query [8447ms]</P> <P>How can I grab only the value "8447"?</P> Mon, 06 Aug 2018 23:33:59 GMT super_virus 2018-08-06T23:33:59Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rex-for-search/m-p/393730#M114466 <P>I have the below log line:<BR /> Slow GraphQL query [8447ms]</P> <P>How can I grab only the value "8447"?</P> Mon, 06 Aug 2018 23:33:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rex-for-search/m-p/393730#M114466 super_virus 2018-08-06T23:33:59Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rex-for-search/m-p/393731#M114467 <P>Hi </P> <P>Please find the following image<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5517iA2980587B46456E4/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 06 Aug 2018 23:47:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rex-for-search/m-p/393731#M114467 PowerPacked 2018-08-06T23:47:28Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rex-for-search/m-p/393732#M114468 <P>Search-time? Index-time? Are all the events similar? Is that the whole event?</P> <P>If you just want a search-time <CODE>rex</CODE> way with the example data being the whole event:</P> <PRE><CODE>... | rex "\[(?P&lt;ms&gt;\d+)ms\]" </CODE></PRE> <P>If it isn't the entire event, then use the <CODE>field=yourfieldname</CODE> option to the <CODE>rex</CODE> command.</P> Mon, 06 Aug 2018 23:51:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rex-for-search/m-p/393732#M114468 cpetterborg 2018-08-06T23:51:52Z