Help with field extraction

[griffinpair]

I have the following event being returned (any event that includes "Streaming"):

Streaming 29 items to https://test.url.com/api/reginvolved/System/Legacy

I need the number after Streaming, in this case 29 (it can potentially be any number), extracted so I can add it up across all "Streaming" events.

It would also be helpful if the url could be extracted as well and I could potentially add up the "Streaming" number based on the urls

Thanks in advance!

[cpetterborg]

If you have similar syntax for all the events, then you can get the count from the line with a regex like the following:

... | rex "Streaming\s+(?P<cnt>\d+)\sitems" | stats sum(cnt)

If your data varies by much, you should be able to make appropriate modifications to the rex. To get the URL as well, you can do it like the following:

... | rex "Streaming\s+(?P<cnt>\d+)\s+items\s+to\s+(?P<url>http\S+)" | stats sum(cnt) by url

or something similar.

[richgalloway]

The rex command makes this easy at search time. Assuming there is nothing after the URL, this should get you started.

index=foo | rex "Streaming\s(?<Streaming>\d+)\sitems\sto\s(?<URL>.*)" | ...

[tiagofbmm · Accepted solution]

Hey

You can do a rex command on this:

| rex field=YOURFIELD "Streaming\s(?<ExtractedNumber>\d+).*(?=https)(?<URL>.*)"

Let me know if it works for you

[tiagofbmm]

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that