Splunk Search

Help with rex expression to capture time

xvxt006
Contributor

Hi,

i have an event like below after ms there is a line break and some other text.
i want to capture that time. i have tried the below expression but it did not work. Any suggestions?

INFO: Server will startup in 2131 ms
sdfsfsdfsdfsff

expression i have used: rex field=_raw "(?i) .? Server will startup in (?P.?)(?=ms)"

Tags (1)
0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

Just needed a slight adjustment to your regex:

(?P<fieldname>\d+)(?=\sms)

View solution in original post

xvxt006
Contributor

Thx for the input. i have tried the other solution and it worked.

0 Karma

strive
Influencer

INFO: Server will startup in (.*)

I tried it in pythex and it worked

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

Just needed a slight adjustment to your regex:

(?P<fieldname>\d+)(?=\sms)

xvxt006
Contributor

Thx. This worked

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...