Here is a log example -
I need to extract the digits after "OK:" (here highlighted in red color) as time in ms. I am just started using splunk. I am trying this -
rex "([^\:]+$)(?P<duration>.+)" | stats exactperc98(duration) as P98 avg(duration) as AVG by log
But this is not working.
Given that you appear to have a field name 'log' already, which is the data from your JSON example, then if that's the field you need to extract duration from, then
| rex field=log "OK:(?<duration>\d+)"
Note that if the encapsulated log didn't result in a 200 OK response, then of course this will not work
It's always best if you have the whole event parsed so you don't accidentaly hit some unexpected string occurrence in other part of the event. But anyway, it should be quite simple
| rex "OK:(?<duration>\d+)\"" | <<your stats>>