Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to extract a field with special characters?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a log statement that prints service execution time like -
Service Response : {"entity":"{\"transactionId\":\"39182d7a-7f34-4c28-a0f2-9b42b9b206df\",\"executionTimeInMillis\":112,"status":201}
I am trying to extract the value of "executionTimeInMillis".
My search statement - index="xyz" "Service Response :" | search "\"executionTimeInMillis\"\":"(?exeTime[^\$]*)," | table _time, exeTime
Note: I have added <> to exeTime. It is not showing in the question.
However, it did not show any results. Can you help me with this query?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The field extraction command is rex, not search. There may be few issues with your regex, e.g. there is no double quotes after colon. So try this
index="xyz" "Service Response :" | rex "\"executionTimeInMillis[^\:]+\:\s*(?<exeTime>[^,]+)" | table _time, exeTime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The field extraction command is rex, not search. There may be few issues with your regex, e.g. there is no double quotes after colon. So try this
index="xyz" "Service Response :" | rex "\"executionTimeInMillis[^\:]+\:\s*(?<exeTime>[^,]+)" | table _time, exeTime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you so much. It worked. Appreciate your help.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
