How do I extract and compare numeric values from a Search result?

[anirbanukil]

Log:

2011-09-28 16:13:12,399 INFO   [ProxyImpl] [INT1] [Interface] Time taken by Call: 743 milliseconds

Requirement: extract the numeric value (743 here) and compare with some threshold value (say 800)

[dwaddle · Accepted solution]

The most expedient way of doing this is with the rex and where commands. You can write a search similar to:

... | rex "Time taken by Call: (?<call_time>\d+) milliseconds"
| where call_time > 800

The rex command can be replaced with a permanent field extraction defined in props.conf and transforms.conf.

[anirbanukil]

Thanks a lot.... It worked...