How can I change duration [5s] to something I can calculate with?

[svester]

Hi, I made a search, and want to finetune it with something like "show duration >20seconds", but duration is showed as "duration [8s]". I tried extracting field and make "duration [8s]" a new extracted field, but I don't know how to calculate with these brackets, or how to define it.
Anyone who can help me out? Thanks!

[svester]

One more problem I'm bumping in now.. what if I also get [..ms], so milliseconds... And I'm searching for, let's say duration>20, now I get results with >20 seconds AND >20 milliseconds. 2 regexes? Any other suggestions?

[dkeck]

you can do a new field yes.

You can change the name of the field to "field_a" duration\s+\[(?<field_a>\d+).

So just give it a name where you now its milliseconds.

[dkeck · Accepted solution]

Hi,

so your field value is now "duration [8s]"?

than use this regex: duration\s+\[(?<field>\d+)

This will only give you the numbers.

[svester]

Thanks! It worked 🙂

[dkeck]

Please accept my answer if it worked 🙂 Thank you

[svester]

Sorry, will do 🙂 Could you please check my 2nd comment? 🙂