How to extract a float value from 2 strings?

[alangularte]

How can I get all the float values that are between the strings "totalElapsedTime^" and "^" from the log sample bellow?

2018-04-21 19:57:26,189 INFO - Sat Apr 21 19:57:26 CDT 2018 ID:<48949.1524358646183.0> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://schemas.dell.com/services/isp/assetheadersearch/03/1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"/>^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipel... null

[TISKAR]

Hello @alangularte, Can you try this:

| rex "totalElapsedTime\^(?<totalElapsedTime>[\d.]*)"  max_match=0

For example:

| makeresults 
| eval _raw="2018-04-21 19:57:26,189 INFO - Sat Apr 21 19:57:26 CDT 2018 ID:<48949.1524358646183.0> xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ns=\"http://schemas.dell.com/services/isp/assetheadersearch/03/1.0\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:env=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully\">http://www.w3.org/2001/XMLSchema-instance\"/>^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully null"
| rex "totalElapsedTime\^(?<totalElapsedTime>[\d.]*)"  max_match=0

[DalJeanis]

Looks like you basically just need a rex.

| rex max_match=0 "\^(?<fieldname>\w+)\^(?<fieldvalue>[0-9.]+)(?=\^)"

This will extract every copy into two multivalue fields. I'm not clear whether your example is two different events, or if you needed the first or second set of data. If you need both, then you have an ambiguity issue due to repeating the same names.

The next step would be stitching each pair together and then using mvexpand to create single records, then assigning the fieldvalues to the fieldnames.

I'll hold off making code for that until you describe what you need to do with the data.

[niketn]

@alangularte, please try out the following rex command:

 <yourBaseSearch>
| rex "totalElapsedTime\^(?<totalElapsedTime>[^\^]+)\^" max_match=0

Following is a run anywhere search based on the the sample data provided:

| makeresults
| eval _raw="2018-04-21 19:57:26,189 INFO - Sat Apr 21 19:57:26 CDT 2018 ID:<48949.1524358646183.0> xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ns=\"http://schemas.dell.com/services/isp/assetheadersearch/03/1.0\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:env=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully\">http://www.w3.org/2001/XMLSchema-instance\"/>^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully null"
| rex "totalElapsedTime\^(?<totalElapsedTime>[^\^]+)\^" max_match=0
| table totalElapsedTime _raw