extract field values

[msarkaus]

Hello, I’m trying to only pull a spefic value from the msgTxt log. In the log below, the example is 2024. This value does change and could be one digit or up to 6 digits.

msgTxt = xxiskServicxxxapper - MxxeNext completed in 2024 ms. (request details: environment: Production | desired services: BusixxxsOwnexxxerritory | property type: Commercial | address: x RxxxDANx DR , xxxSHFIELD , xx 02xx0)

Below is the search I'm trying to use but its not working. Any help would be apreseated.

| eval msgTxt=" msgTxt: xxiskServicxxxapper - MxxeNext completed in 2024 ms. (request details: environment: Production | desired services: BusixxxsOwnexxxerritory*"
| rex "in=(?<in>\w+)."
| stats count by in

[richgalloway · Accepted solution]

You're very close.  Use \d (digit) in place of \w (word).  Also, remove the '=' since there is no such character in the data.

| rex "in (?<in>\d+)"

[msarkaus]

Sorry to be a bother, but what if there is a special char like = involved. I can't add the equal sign into my search query.

| eval msxxxt="*Action=GexxxxdledxxxxReport Duration=853*"
| rex "Duration (<?Duration>\d+)"
| timechart span=1h avg(Duration) AS avg_response by msxxxt

Thanks again for your help

[richgalloway]

The search command cannot search for '*'.  The '=' character also is a challenge.  You can, however, use regex to filter on these and other "special" characters.

| eval msxxxt="*Action=GexxxxdledxxxxReport Duration=853*"
| regex "="
| rex "Duration (<?Duration>\d+)"
| timechart span=1h avg(Duration) AS avg_response by msxxxt

[msarkaus]

Thank you