Splunk Search

Extracting data which is incosistent

nateNpgh
Loves-to-Learn Lots

I need to extract a time value from log file where the time value appears with a few different variations of characters around it.  I'm struggling with handling all the variations through my regex extract.

Below are examples of each of the variations:

ChainedQuery elapsed time [90]ms

Elapsed time: 114ms

Elapsed time to get Service pool: 339

Elapsed Time: 69

,took 37ms

Is there a way to extract all the numeric values with 1 regex?

 

Labels (2)
0 Karma

nateNpgh
Loves-to-Learn Lots

I just need to be able to handle the variations I included.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Just use an alternative within a group and you're set.

(Prefix1|prefix2|prefix3)(?<capture_field>\d+)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

With those examples this should work https://regex101.com/r/jBOkh7/1

\s+[\[]?(\d+)

But this expecting that in field where you are extracting these values haven't been anything else. If those contains other text you need to modify that.

r. Ismo 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It depends how many different variants you expect to encounter and how fool-proof you want this solution to be. If you go too broadly - for example extracting every sequence of digits after a "elapsed" word (would need a separate branch for the "took" version) - you risk getting unrelated data extracted.

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...