How to extract fields with a value greater than 3 seconds?

[sp_lunky]

First sorry for my english. I'm testing Splunk at the moment, and i have a task to extract a field from *.log files.

Raw value is :

..xxxxxxxxxxxxxxx Duration: 1 s. 466 ms....
..xxxxxxxxxxxxxxx Duration: 4 s. 066 ms...
..xxxxxxxxxxxxxxx Duration: 12 s. 300 ms...

I want to to make an alert when the Duration is greater than 3 s

for a Report I filtered with search command, but it won't show the value like: "11", "12"

host=NAME | search (duration:"4" OR "5" OR "6" OR "7" OR "8" OR "9" ) 

Any help please!?

[sp_lunky]

Thank you very much! Both are good and working. But I accepted paulstout answer because it satisfy both my needs.
Thank you again!

[DalJeanis]

I believe you can accept more than one answer, if they both helped.

[sp_lunky]

Sorry, i didn't now that

[paulstout · Accepted solution]

Could you try this search?

host=name | rex field=_raw "Duration\:\s(?<duration_s>\d+)\ss\.\s+(?<duration_ms>\d+)\sms" | eval duration=duration_s+(duration_ms/1000) | search duration_s="*"?

This would give you a float with the actual duration in duration and separate fields for the second and millisecond component to use your original filtering.

[paulstout]

To meet the original 3 second requirement, | where duration_s>3 or | search duration_s>3 should suffice.

[vasanthmss]

try this,

your base search | rex "Duration:\s+(?<duration>\d+)" | where duration>3

Hope this will help you.

[somesoni2]

The threshold sp_lunky looking for is 3 sec. You may want to correct it.

[vasanthmss]

updated the answer.