event with time record

[benji00]

Hello,

I have a field containing an execution time looking like: 100s and which is corresponding to 100 seconds.
The field is only in second, so my concern is only to remove the final S to have a field with only numbers, any idea about how to do?

Regards,

[renjith_nair · Accepted solution]

@benji00 ,

Try

|rex field=execution_time "(?<sec>\d+)"

where execution_time is your field name

[benji00]

@renjith.nair,
OK but then how can I call my filtered out field?
Because at the end I want to use it to calculate a difference with another sub-process execution time (already conatining only numbers)...

[benji00]

Thanks... it is working as expected (y)

[renjith_nair]

@benji00 ,
The seconds will be in the field sec . You may use any other field name

See this run anywhere example

|makeresults|eval execution_time="100s"|rex field=execution_time "(?<seconds>\d+)"|fields execution_time,seconds