How to edit my regular expression to extract numbers before key characters in my sample data?

[JoshuaJohn]

I have this statement:

10.211.1.114    10.222.3.33:4331    -   2016-09-07  14:10:06    0.004   GET /openapi-rest-web/akamai-object.htm -   200 6548    "Java/1.7.0_45" "54.444.444.444"    -   null    [corRID::null]  [KEY::-HTTPMonitor-Loyalty] [UID::-]

I am trying to grab the 0.004

10.200.1.200    10.002.0.98:012 -   2016-09-07  14:40:06    0.39    POST    /openapi-rest-web/v1/kohlsCash  -   200 918 "Apache-HttpClient/4.3.3 (java 1.5)"    "100.100.00.187, 144.41.141.00, 144.41.141.44, 54.009.200.002, 144.41.141.44"   -   null    [corRID::NAID-iOS-98797AB9-2978-4987-90CA-059879789-1473276124.978987]  [KEY::NUNlVg4532432523mLL8MEpqVvxW9]    [UID::-]

I am trying to grab the 0.39

I have this regular expression so far: ^.*(GET|POST)
Which gets me everything before the GET or POST

Any suggestions?

[somesoni2]

This should do it

your base search | rex "^(\S+\s+){5}(?<YourFieldName>\S+)"

[sundareshr · Accepted solution]

Try this

... | rex "(?<numbers>\d+\.\d+)\s(GET|POST)" | table numbers

[JoshuaJohn]

Doesn't seem to work sorry, only getting blank null entries using that

[JoshuaJohn]

| rex "(?\d+\.\d+)\s(GET|POST)" | where match(response_time,"[a-zA-Z0-9]")| table response_time

This did it