Splunk Search

How do I extract and compare numeric values from a Search result?

anirbanukil
Explorer

Log:

2011-09-28 16:13:12,399 INFO   [ProxyImpl] [INT1] [Interface] Time taken by Call: 743 milliseconds

Requirement: extract the numeric value (743 here) and compare with some threshold value (say 800)

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

The most expedient way of doing this is with the rex and where commands. You can write a search similar to:

... | rex "Time taken by Call: (?<call_time>\d+) milliseconds"
| where call_time > 800

The rex command can be replaced with a permanent field extraction defined in props.conf and transforms.conf.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

The most expedient way of doing this is with the rex and where commands. You can write a search similar to:

... | rex "Time taken by Call: (?<call_time>\d+) milliseconds"
| where call_time > 800

The rex command can be replaced with a permanent field extraction defined in props.conf and transforms.conf.

anirbanukil
Explorer

Thanks a lot.... It worked...

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...