https://community.splunk.com/t5/Splunk-Search/Regex-help-to-extract-number/m-p/173078#M49635 <P>Try this</P> <PRE><CODE>your base search | rex ": (?&lt;decode_time&gt;\d+)ms$" </CODE></PRE> Wed, 06 Aug 2014 13:25:27 GMT somesoni2 2014-08-06T13:25:27Z https://community.splunk.com/t5/Splunk-Search/Regex-help-to-extract-number/m-p/173077#M49634 <P>Hello,</P> <P>My logs contain some sentence like :<BR /> "2014-07-22 14:47:10,783 INFO [LoggingInterceptor]|EXIT: CmsXwbDecodingPayloadDriver.decode() : 15ms"</P> <P>I want to extract the '15' (from '15ms') in a field "decode_time" and display the result for each corresponding event.</P> <P>I am cleary not confident with regular expressions.</P> <P>What should I do ?</P> <P>Thank you</P> Wed, 06 Aug 2014 13:16:13 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help-to-extract-number/m-p/173077#M49634 splunksogetiht 2014-08-06T13:16:13Z https://community.splunk.com/t5/Splunk-Search/Regex-help-to-extract-number/m-p/173078#M49635 <P>Try this</P> <PRE><CODE>your base search | rex ": (?&lt;decode_time&gt;\d+)ms$" </CODE></PRE> Wed, 06 Aug 2014 13:25:27 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help-to-extract-number/m-p/173078#M49635 somesoni2 2014-08-06T13:25:27Z https://community.splunk.com/t5/Splunk-Search/Regex-help-to-extract-number/m-p/173079#M49636 <P>Something like this should do the job.</P> <PRE><CODE>rex "(?&lt;decode_time&gt;\d+)ms$" </CODE></PRE> Wed, 06 Aug 2014 13:27:53 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help-to-extract-number/m-p/173079#M49636 richgalloway 2014-08-06T13:27:53Z https://community.splunk.com/t5/Splunk-Search/Regex-help-to-extract-number/m-p/173080#M49637 <P>Nice !</P> <P>Thank you</P> Wed, 06 Aug 2014 13:33:48 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help-to-extract-number/m-p/173080#M49637 splunksogetiht 2014-08-06T13:33:48Z