topic Extracting a number a my query not working in Splunk Search

Extracting a number a my query not working

ramkrishs — Sun, 14 Nov 2021 19:12:43 GMT

Hi i have a log like this Elapsed time: prediction timer 0.1953 seconds

and i created a rex like this rex "Elapsed\stime:\sprediction\stimer\s(?<predictionTime>\d+)\sseconds"

but i am unable to find the value at all what am i missing here ? any help would be appreciated

PickleRick — Sun, 14 Nov 2021 19:22:26 GMT

Your regex specifies that your capture group consists of digits only (at least one digit) and then immediately you get a space.

In your event you have a decimal fraction as well.

So you need

\d+(\.\d+)?