Help extracting a value from this log?

[rajgowd1]

Hi,
can someone help me to exact "536 MiliSeconds" from below is log

6>2017-11-02T05:55:12Z d065d14b-3bcd-481c-512a-bfd42485714d doppler[15]: {"cf_app_id":"d5632633-2365-4b73-83ba-27d0xxxxxxxxx","cf_app_name":"xln-sm-d-MarketingExtOffer-xxxx","cf_ignored_app":false,"cf_org_id":"xxxxxxxx-6ecd-4af6-a32d-xxxxxxxxxx","cf_org_name":"CROSS_xxx-NAM","cf_origin":"xxxxxxxxx","cf_space_id":"xxxxxxxxxx-aa31-414a-88bc-xxxxxxxxx","cf_space_name":"SALES_MKTG-SIT3","deployment":"cf","event_type":"LogMessage","ip":"153.40.210.253","job":"diego_cell-partition-xxxxxxxxxx","job_index":"71","level":"info","message_type":"OUT","msg":" INFO [nio-8080-exec-9] c.c.e.i.u.ExtOfferConnectionUtil c.c.e.i.u.ExtOfferLogUtil.logInfo(ExtOfferLogUtil.java:27) - POST|/private/v1/offer/rocketFuel|84f85631-114f-41f5-9824-xxxxxxxxxx|372aae13-728c-4002-87f5-xxxxxxxxxxx|||||||||||ExtOfferConnectionUtil- Time taken for ExtOfferConnectionUtil.sendRF is : 536 MiliSeconds","origin":"rep","source_instance":"0","source_type":"APP","time":"2017-11-02T05:55:12Z","timestamp":1509602112630605039

[niketn]

@rajgowd1, try the following rex command:

<YourBaseSearch>
| rex "Time taken for ExtOfferConnectionUtil\.sendRF is : (?<time>[^\"]+)\""

[rajgowd1]

Hi Thank you, i just want the number.can you help on this
like

536

[niketn]

@rajgowd1, please try the following then, it breaks field extraction the moment it encounters a space.

<YourBaseSearch>
 | rex "Time taken for ExtOfferConnectionUtil\.sendRF is : (?<time>[^\s]+)\s"

You should try to use https://regex101.com/ for creating and testing regular expression with your sample data.