https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-response-time-from-the-following-log/m-p/441954#M166885 <P>tried the below:<BR /> rex field=_raw "Time taken to get Response in millis\"\s:\s\"(?[^\"]+)" </P> <P>not able to get the output</P> Tue, 23 Oct 2018 20:37:25 GMT yograjpatel 2018-10-23T20:37:25Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-response-time-from-the-following-log/m-p/441952#M166883 <P>INFO -Transaction successful. Time taken to get Response in millis:29; XURA Response Content:\u003c?xml version="1.0" encoding="utf-8"?\u003e</P> Tue, 23 Oct 2018 20:23:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-response-time-from-the-following-log/m-p/441952#M166883 yograjpatel 2018-10-23T20:23:46Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-response-time-from-the-following-log/m-p/441953#M166884 <P>@yograjpatel Try this</P> <PRE><CODE>|rex field=_raw "\W+millis:(?&lt;response_time&gt;\d+);" </CODE></PRE> Tue, 23 Oct 2018 20:37:24 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-response-time-from-the-following-log/m-p/441953#M166884 Vijeta 2018-10-23T20:37:24Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-response-time-from-the-following-log/m-p/441954#M166885 <P>tried the below:<BR /> rex field=_raw "Time taken to get Response in millis\"\s:\s\"(?[^\"]+)" </P> <P>not able to get the output</P> Tue, 23 Oct 2018 20:37:25 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-response-time-from-the-following-log/m-p/441954#M166885 yograjpatel 2018-10-23T20:37:25Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-response-time-from-the-following-log/m-p/441955#M166886 <PRE><CODE>| rex field=_raw "\w+\:(?&lt;timeinmillis&gt;\d+)\;" </CODE></PRE> Wed, 24 Oct 2018 02:37:49 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-response-time-from-the-following-log/m-p/441955#M166886 Rob2520 2018-10-24T02:37:49Z