From the below portion of the log file, I want to display only the
Elapsed Time: 01:05:22.0348974.
Can you pls help me with this?
-- 2/6/2016 11:02:42 AM Setup Completed Elapsed Time: 01:05:22.0348974 Setup Complete
Tried most of the suggested rex, but no luck:
| rex field=_raw "S(?<Elpased>\w*)"
sorry for the typo above. Below is the once I tried
> | rex field=_raw "Job Completed at > \s(?<completion_time>[^ \n\r]+)"
this shows the completion_time column but null values are in it... any ideas?
Another issue with your regex is that you've written both a space " " and \s (that's space too) after "at", but your data has just 1 space. Did you try the one I posted?
Hi , I was able to fetch the Elapsed time as above but when I try the same for completion time, it doesn't display anything. pls advise If I need to change anything
Job Completed at 2/10/2016 12:10:26 PM
00:09:43.7907662 Kernel mode CPU Time:
00:00:13.2181970 User mode CPU Time:
00:00:38.9404230 Total page faults:
| rex field=_raw "Job Completed at :\s(?<completion_time>[^ \n\r]+)"
I don't see a colon ":" before the time in the data (as you'd see with Elapsed Time). So probably just remove that. Also, for Elapsed time there was only time part with no spaces in between, so you'd need a different rex for this.
| rex field=_raw "Job Completed at\s+(?<completion_time>\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+\w+)"