Splunk Search

Help with rex expression to capture time

xvxt006
Contributor

Hi,

i have an event like below after ms there is a line break and some other text.
i want to capture that time. i have tried the below expression but it did not work. Any suggestions?

INFO: Server will startup in 2131 ms
sdfsfsdfsdfsff

expression i have used: rex field=_raw "(?i) .? Server will startup in (?P.?)(?=ms)"

Tags (1)
0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

Just needed a slight adjustment to your regex:

(?P<fieldname>\d+)(?=\sms)

View solution in original post

xvxt006
Contributor

Thx for the input. i have tried the other solution and it worked.

0 Karma

strive
Influencer

INFO: Server will startup in (.*)

I tried it in pythex and it worked

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

Just needed a slight adjustment to your regex:

(?P<fieldname>\d+)(?=\sms)

xvxt006
Contributor

Thx. This worked

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...