topic Re: How to extract only one value in a regex search? in Splunk Search

How to extract only one value in a regex search?

leandrodematosp — Tue, 02 Jun 2020 18:12:44 GMT

How do I get only the value that is before the ms?
Remember that this log is multiline, each statement is an event.

Ex: 13657, 5469, 6000

2020-06-02 18:01:04,331 INFO  ect-1-1rere872 25000 Execution Info
+[Job_ExtractICON].......................................................................13657 ms. Invocations 1
2020-06-02 17:48:40,449 INFO  ecp-2-14343527 25000 Execution Info
+[Job_ExtractICON].................................................................................5469 ms. Invocations 1
2020-06-02 17:45:27,697 INFO  ecj-1-16576 25000 Execution Info
+[Job_ExtractICON]...........................................................................6000 ms. Invocations 1

Re: How to extract only one value in a regex search?

jscraig2006 — Tue, 02 Jun 2020 20:41:15 GMT

you can try \.{70}(?<num>\d+) if the periods are always 70 in count. or \.(?<num>\d+)\s+ms

Re: How to extract only one value in a regex search?

gcusello — Wed, 03 Jun 2020 06:41:10 GMT

Hi
you can try something like this:

| rex "(?ms)(?<time>\d+)\s+ms\."

that you can test at https://regex101.com/r/qjVfQW/1

Ciao.
Giuseppe