Getting Data In

event with time record

benji00
New Member

Hello,

I have a field containing an execution time looking like: 100s and which is corresponding to 100 seconds.
The field is only in second, so my concern is only to remove the final S to have a field with only numbers, any idea about how to do?

Regards,

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@benji00 ,

Try

|rex field=execution_time "(?<sec>\d+)"

where execution_time is your field name

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@benji00 ,

Try

|rex field=execution_time "(?<sec>\d+)"

where execution_time is your field name

Happy Splunking!
0 Karma

benji00
New Member

@renjith.nair,
OK but then how can I call my filtered out field?
Because at the end I want to use it to calculate a difference with another sub-process execution time (already conatining only numbers)...

0 Karma

benji00
New Member

Thanks... it is working as expected (y)

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@benji00 ,
The seconds will be in the field sec . You may use any other field name

See this run anywhere example

|makeresults|eval execution_time="100s"|rex field=execution_time "(?<seconds>\d+)"|fields execution_time,seconds
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...