How do I extract a number from the raw message

[JeffCr]

How do I extract the following which always occurs as the last part of the raw text in message e.g "Took 13983.1468ms."
I want only the number and to capture timestamp and hostname. The total message length and structure might vary slightly but the ending is the same.

[twinspop]

| rex "Took (?P<dur>\d+\.?\d*)ms"

Will put the value into dur

[richgalloway · Accepted solution]

I'd use rex.

index=foo | rex "Took (?<num>\d+\.?\d+)ms" | ...

If you need help extracting timestamp and hostname, please show some sample data.

[twinspop]

I think that regex is going to surprise in some situations. You are requiring that there be 2 digits. 1 or more digits, followed by optional decimal, followed by 1 or more digits.

[JeffCr]

There will always be at least x.x

[richgalloway]

To alert on certain values, schedule a search for those values.

index=foo | rex "Took (?<num>\d+\.?\d+)ms" | where num > someThreshold | table _time hostname num

Have the search trigger an alert if the number of results is not zero.

[JeffCr]

Many thanks for the answer!

[skoelpin]

You would use a regular expression..

Try this

| rex (?P<Time>(?<=Took\s)\d+(?=ms))

[twinspop]

This doesn't allow for decimals.

[skoelpin]

Sorry about that, try this

| rex (?P<Time>(?<=Took\s)\d+\.\d+(?=ms))

[JeffCr]

Whats the easiest way to search the result set and then alert on a threshold value(s). Do I need to pass this into a command to build a table first?

[skoelpin]

No you don't need to do that, you can add a | where clause such as

... | where Time > 2