Getting Data In

event with time record

benji00
New Member

Hello,

I have a field containing an execution time looking like: 100s and which is corresponding to 100 seconds.
The field is only in second, so my concern is only to remove the final S to have a field with only numbers, any idea about how to do?

Regards,

Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

@benji00 ,

Try

|rex field=execution_time "(?<sec>\d+)"

where execution_time is your field name

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:

View solution in original post

0 Karma

renjith_nair
Legend

@benji00 ,

Try

|rex field=execution_time "(?<sec>\d+)"

where execution_time is your field name

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma

benji00
New Member

@renjith.nair,
OK but then how can I call my filtered out field?
Because at the end I want to use it to calculate a difference with another sub-process execution time (already conatining only numbers)...

0 Karma

benji00
New Member

Thanks... it is working as expected (y)

0 Karma

renjith_nair
Legend

@benji00 ,
The seconds will be in the field sec . You may use any other field name

See this run anywhere example

|makeresults|eval execution_time="100s"|rex field=execution_time "(?<seconds>\d+)"|fields execution_time,seconds
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...