Following is the sample event:
2018-05-31 13:05:32.673, SQL_ID="5y1v8tznxf4t1", DBID="3602297620", SQL_TEXT="SELECT "MBLNR","MJAHR","BWART","MATNR","WERKS","LGORT","WAERS","DMBTR","MENGE","SGTXT","GRUND","BUDAT_MKPF","USNAM_MKPF" FROM "MSEG" WHERE "MANDT"=:A0 AND "BUDAT_MKPF" BETWEEN :A1 AND :A2 AND "WERKS"=:A3 AND "BWART" BETWEEN :A4 AND :A5", ELAPSED_TIME="2876.465675", TOTAL_TIME="5752.93135", EXEC="2"
Required Field is in bold.
I want ELAPSED_TIME as field and its value.
Please try this:
| makeresults
| eval data="2018-05-31 13:05:32.673, SQL_ID=\"5y1v8tznxf4t1\", DBID=\"3602297620\", SQL_TEXT=\"SELECT \"MBLNR\",\"MJAHR\",\"BWART\",\"MATNR\",\"WERKS\",\"LGORT\",\"WAERS\",\"DMBTR\",\"MENGE\",\"SGTXT\",\"GRUND\",\"BUDAT_MKPF\",\"USNAM_MKPF\" FROM \"MSEG\" WHERE \"MANDT\"=:A0 AND \"BUDAT_MKPF\" BETWEEN :A1 AND :A2 AND \"WERKS\"=:A3 AND \"BWART\" BETWEEN :A4 AND :A5\", ELAPSED_TIME=\"2876.465675\", TOTAL_TIME=\"5752.93135\", EXEC=\"2"
| rex field=data ", ELAPSED_TIME=\"(?<numValue>\d+\.\d+)\""
| table data,numValue
This should do the trick:
| rex "ELAPSED_TIME=\"(?<ELAPSED_TIME>[^\"]+)\"