topic How do I extract and compare numeric values from a Search result? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-and-compare-numeric-values-from-a-Search-result/m-p/83205#M21167 <P>Log: </P> <PRE><CODE>2011-09-28 16:13:12,399 INFO [ProxyImpl] [INT1] [Interface] Time taken by Call: 743 milliseconds </CODE></PRE> <P>Requirement: extract the numeric value (743 here) and compare with some threshold value (say 800)</P> Wed, 28 Sep 2011 20:50:21 GMT anirbanukil 2011-09-28T20:50:21Z How do I extract and compare numeric values from a Search result? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-and-compare-numeric-values-from-a-Search-result/m-p/83205#M21167 <P>Log: </P> <PRE><CODE>2011-09-28 16:13:12,399 INFO [ProxyImpl] [INT1] [Interface] Time taken by Call: 743 milliseconds </CODE></PRE> <P>Requirement: extract the numeric value (743 here) and compare with some threshold value (say 800)</P> Wed, 28 Sep 2011 20:50:21 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-and-compare-numeric-values-from-a-Search-result/m-p/83205#M21167 anirbanukil 2011-09-28T20:50:21Z Re: How do I extract and compare numeric values from a Search result? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-and-compare-numeric-values-from-a-Search-result/m-p/83206#M21168 <P>The most expedient way of doing this is with the <CODE>rex</CODE> and <CODE>where</CODE> commands. You can write a search similar to:</P> <PRE><CODE>... | rex "Time taken by Call: (?&lt;call_time&gt;\d+) milliseconds" | where call_time &gt; 800 </CODE></PRE> <P>The <CODE>rex</CODE> command can be replaced with a permanent field extraction defined in <CODE>props.conf</CODE> and <CODE>transforms.conf</CODE>.</P> Wed, 28 Sep 2011 21:13:06 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-and-compare-numeric-values-from-a-Search-result/m-p/83206#M21168 dwaddle 2011-09-28T21:13:06Z Re: How do I extract and compare numeric values from a Search result? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-and-compare-numeric-values-from-a-Search-result/m-p/83207#M21169 <P>Thanks a lot.... It worked...</P> Thu, 29 Sep 2011 14:37:48 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-and-compare-numeric-values-from-a-Search-result/m-p/83207#M21169 anirbanukil 2011-09-29T14:37:48Z