Splunk Search
Highlighted

How do I use rex command here?

Engager

sample event:

fullFormattedMessage: Device naa.60000970000297500017533030313231 performance has improved. I/O latency reduced from 3746 microseconds to 1859 microseconds.

Required field is in bold.

0 Karma
Highlighted

Re: How do I use rex command here?

SplunkTrust
SplunkTrust

Hi @harshal94 ,

If the format of the string going to be same, then you can use split also (much easier)

|stats count|eval xyz="fullFormattedMessage: Device naa.60000970000297500017533030313231 performance has improved. I/O latency reduced from 3746 microseconds to 1859 microseconds."|eval splitted=split(xyz," ")|eval micsecs=mvindex(splitted,mvcount(splitted)-2)
Highlighted

Re: How do I use rex command here?

Builder

Hi,

try this

|  makeresults |  eval str="Device naa.60000970000297500017533030313231 performance has improved. I/O latency reduced from 3746 microseconds to 1859 microseconds"
|  rex field=str "microseconds to (?<value>\d+) microseconds"

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.