Hello,
I have a field containing an execution time looking like: 100s and which is corresponding to 100 seconds.
The field is only in second, so my concern is only to remove the final S to have a field with only numbers, any idea about how to do?
Regards,
@benji00 ,
Try
|rex field=execution_time "(?<sec>\d+)"
where execution_time
is your field name
@benji00 ,
Try
|rex field=execution_time "(?<sec>\d+)"
where execution_time
is your field name
@renjith.nair,
OK but then how can I call my filtered out field?
Because at the end I want to use it to calculate a difference with another sub-process execution time (already conatining only numbers)...
Thanks... it is working as expected (y)
@benji00 ,
The seconds will be in the field sec
. You may use any other field name
See this run anywhere example
|makeresults|eval execution_time="100s"|rex field=execution_time "(?<seconds>\d+)"|fields execution_time,seconds