Splunk Search

Extracting data which is incosistent

nateNpgh
Loves-to-Learn Lots

I need to extract a time value from log file where the time value appears with a few different variations of characters around it.  I'm struggling with handling all the variations through my regex extract.

Below are examples of each of the variations:

ChainedQuery elapsed time [90]ms

Elapsed time: 114ms

Elapsed time to get Service pool: 339

Elapsed Time: 69

,took 37ms

Is there a way to extract all the numeric values with 1 regex?

 

Labels (2)
0 Karma

nateNpgh
Loves-to-Learn Lots

I just need to be able to handle the variations I included.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Just use an alternative within a group and you're set.

(Prefix1|prefix2|prefix3)(?<capture_field>\d+)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

With those examples this should work https://regex101.com/r/jBOkh7/1

\s+[\[]?(\d+)

But this expecting that in field where you are extracting these values haven't been anything else. If those contains other text you need to modify that.

r. Ismo 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It depends how many different variants you expect to encounter and how fool-proof you want this solution to be. If you go too broadly - for example extracting every sequence of digits after a "elapsed" word (would need a separate branch for the "took" version) - you risk getting unrelated data extracted.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...