topic Re: field extraction in Splunk Search

field extraction

vinod0313 — Mon, 24 May 2021 09:35:19 GMT

I have logs like below
findContractsByPersonId(String) executed in 463 milliseconds
findContractsByPersonId(String) executed in 4,681 milliseconds
findContractsByPersonId(String) executed in 3,671 milliseconds
findContractsByPersonId(String) executed in 681 milliseconds

and i want to create a field which will give values from log like below
463
4,681
3,671
681

i did filed extraction with below log
findContractsByPersonId(String) executed in 463 milliseconds

i am able to create filed but i can only get non coma separated values, i mean i am getting only
463
681 values
i am not getting coma included values (those are 4,681 and 3,671)
could you please suggest in order to get all the values (comma included values also)

Re: field extraction

javiergn — Mon, 24 May 2021 09:53:09 GMT

Hi @vinod0313 ,

You could try with the rex command and the following regex for instance:

| rex "in (?<value>[\d\,\.]+) milliseconds$"

Let me know if that helps.

Regards,

Re: field extraction

vinod0313 — Mon, 24 May 2021 10:11:45 GMT

Thanks @javiergn
it worked.

Re: field extraction

vinod0313 — Mon, 24 May 2021 11:20:05 GMT

HI @javiergn

is there any chance we can disply the result without comma.As of now we are getting 2,061 but i want as 2061(comma should not be in the result)

Re: field extraction

javiergn — Mon, 24 May 2021 12:21:25 GMT

Yes, you can use the rex command again with the mode=sed to remove the comma. Assuming your field name is "value" it would be something like:

| rex field=value mode=sed "s/\,//g"

If that worked for you please don't forget to upvote the answer so that others can benefit from it.

Regards,