topic Extracting data which is incosistent in Splunk Search

Extracting data which is incosistent

nateNpgh — Fri, 30 Jun 2023 13:15:47 GMT

I need to extract a time value from log file where the time value appears with a few different variations of characters around it. I'm struggling with handling all the variations through my regex extract.

Below are examples of each of the variations:

ChainedQuery elapsed time [90]ms

Elapsed time: 114ms

Elapsed time to get Service pool: 339

Elapsed Time: 69

,took 37ms

Is there a way to extract all the numeric values with 1 regex?

Re: Extracting data which is incosistent

PickleRick — Fri, 30 Jun 2023 13:35:36 GMT

It depends how many different variants you expect to encounter and how fool-proof you want this solution to be. If you go too broadly - for example extracting every sequence of digits after a "elapsed" word (would need a separate branch for the "took" version) - you risk getting unrelated data extracted.

Re: Extracting data which is incosistent

nateNpgh — Fri, 30 Jun 2023 13:38:03 GMT

I just need to be able to handle the variations I included.

Re: Extracting data which is incosistent

PickleRick — Fri, 30 Jun 2023 13:41:24 GMT

Just use an alternative within a group and you're set.

(Prefix1|prefix2|prefix3)(?<capture_field>\d+)

Re: Extracting data which is incosistent

isoutamo — Tue, 04 Jul 2023 17:34:49 GMT

With those examples this should work https://regex101.com/r/jBOkh7/1

\s+[\[]?(\d+)

But this expecting that in field where you are extracting these values haven't been anything else. If those contains other text you need to modify that.

r. Ismo