Splunk Search

Help extracting a value from this log?

rajgowd1
Communicator

Hi,
can someone help me to exact "536 MiliSeconds" from below is log

6>2017-11-02T05:55:12Z d065d14b-3bcd-481c-512a-bfd42485714d doppler[15]: {"cf_app_id":"d5632633-2365-4b73-83ba-27d0xxxxxxxxx","cf_app_name":"xln-sm-d-MarketingExtOffer-xxxx","cf_ignored_app":false,"cf_org_id":"xxxxxxxx-6ecd-4af6-a32d-xxxxxxxxxx","cf_org_name":"CROSS_xxx-NAM","cf_origin":"xxxxxxxxx","cf_space_id":"xxxxxxxxxx-aa31-414a-88bc-xxxxxxxxx","cf_space_name":"SALES_MKTG-SIT3","deployment":"cf","event_type":"LogMessage","ip":"153.40.210.253","job":"diego_cell-partition-xxxxxxxxxx","job_index":"71","level":"info","message_type":"OUT","msg":" INFO [nio-8080-exec-9] c.c.e.i.u.ExtOfferConnectionUtil c.c.e.i.u.ExtOfferLogUtil.logInfo(ExtOfferLogUtil.java:27) - POST|/private/v1/offer/rocketFuel|84f85631-114f-41f5-9824-xxxxxxxxxx|372aae13-728c-4002-87f5-xxxxxxxxxxx|||||||||||ExtOfferConnectionUtil- Time taken for ExtOfferConnectionUtil.sendRF is : 536 MiliSeconds","origin":"rep","source_instance":"0","source_type":"APP","time":"2017-11-02T05:55:12Z","timestamp":1509602112630605039

0 Karma

niketn
Legend

@rajgowd1, try the following rex command:

<YourBaseSearch>
| rex "Time taken for ExtOfferConnectionUtil\.sendRF is : (?<time>[^\"]+)\""
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

rajgowd1
Communicator

Hi Thank you, i just want the number.can you help on this
like

536

0 Karma

niketn
Legend

@rajgowd1, please try the following then, it breaks field extraction the moment it encounters a space.

<YourBaseSearch>
 | rex "Time taken for ExtOfferConnectionUtil\.sendRF is : (?<time>[^\s]+)\s"

You should try to use https://regex101.com/ for creating and testing regular expression with your sample data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...