I am trying to get a value, in this case it is the # of seconds to respond, so that I can graph it or set alerts to it. Below are the log entries I am dealing with.
STATUS | wrapper | main | 2019/02/10 10:38:08.885 | Pinging the JVM took 5 seconds to respond.
So I need help pulling the number and the search for being able to graph this per a host.
Assuming your log format is consistent, this will do the trick
| rex JVM\s\took\s(?<jvm_duration>\d+)\sseconds
| timechart avg(jvm_duration) AS jvm_duration by host
index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| rex "took\s+(?<responseSeconds>\d+)\s+seconds"
| timechart avg(responseSeconds) BY host