I have a field that contains a text string representing time ("900 ms" for example - all values are in milliseconds) is there a way to extract a number, so i can find values "greater than" or "smaller than"?
try this
...|rex field=<fieldname> "(?<ms>\d+)"
include your fieldname here
Hello,
Can you try this please:
|makeresults | eval field="900 ms" | rex field=field "(?<field>\d+)"
Regards
try this
...|rex field=<fieldname> "(?<ms>\d+)"
include your fieldname here
thanks !!!