Splunk Search

Extracting data which is incosistent

nateNpgh
Loves-to-Learn Lots

I need to extract a time value from log file where the time value appears with a few different variations of characters around it.  I'm struggling with handling all the variations through my regex extract.

Below are examples of each of the variations:

ChainedQuery elapsed time [90]ms

Elapsed time: 114ms

Elapsed time to get Service pool: 339

Elapsed Time: 69

,took 37ms

Is there a way to extract all the numeric values with 1 regex?

 

Labels (2)
0 Karma

nateNpgh
Loves-to-Learn Lots

I just need to be able to handle the variations I included.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Just use an alternative within a group and you're set.

(Prefix1|prefix2|prefix3)(?<capture_field>\d+)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

With those examples this should work https://regex101.com/r/jBOkh7/1

\s+[\[]?(\d+)

But this expecting that in field where you are extracting these values haven't been anything else. If those contains other text you need to modify that.

r. Ismo 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It depends how many different variants you expect to encounter and how fool-proof you want this solution to be. If you go too broadly - for example extracting every sequence of digits after a "elapsed" word (would need a separate branch for the "took" version) - you risk getting unrelated data extracted.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...