topic REGEX in Splunk Search

REGEX

dteixeira98 — Fri, 09 Jul 2021 09:46:31 GMT

Hi guys, im noob in regular expressions!!

2021-07-05 23:22:12.807 +01:00 [WRN] XXXXX.Membership.Renew Long Running Request: IntegratePaymentCommand (1082 milliseconds) Jobs {"BatchSize":10,"MaxRetry":5,"$type":"IntegratePaymentCommand"}

What if I want to take [WRN] as event_level.. can be [WRN] or [ERR].
And ( xxxxx miliseconds) as time.

Re: REGEX

venkatasri — Fri, 09 Jul 2021 11:03:09 GMT

Hi @dteixeira98 Can you try this?

<your_search_goes_here> | rex "\[(?<level>\w+)\].+\((?<time_taken>\d+)\s+milliseconds"

Field level will have WRN, ERR, ERROR etc and time_taken would be milliseconds.

An upvote would be appreciated and Accept solution if this reply helps!

Re: REGEX

dteixeira98 — Fri, 09 Jul 2021 11:29:54 GMT

Thanks that really helped me!

Re: REGEX

venkatasri — Fri, 09 Jul 2021 11:30:55 GMT

@dteixeira98 Great! Appreciate if you could Accept the solution that helps others.