Splunk Search

How to extract only one value in a regex search?

leandrodematosp
New Member

How do I get only the value that is before the ms?
Remember that this log is multiline, each statement is an event.

Ex: 13657, 5469, 6000

2020-06-02 18:01:04,331 INFO  ect-1-1rere872 25000 Execution Info
+[Job_ExtractICON].......................................................................13657 ms. Invocations 1
2020-06-02 17:48:40,449 INFO  ecp-2-14343527 25000 Execution Info
+[Job_ExtractICON].................................................................................5469 ms. Invocations 1
2020-06-02 17:45:27,697 INFO  ecj-1-16576 25000 Execution Info
+[Job_ExtractICON]...........................................................................6000 ms. Invocations 1
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
you can try something like this:

| rex "(?ms)(?<time>\d+)\s+ms\."

that you can test at https://regex101.com/r/qjVfQW/1

Ciao.
Giuseppe

0 Karma

jscraig2006
Communicator

you can try \.{70}(?<num>\d+) if the periods are always 70 in count. or \.(?<num>\d+)\s+ms

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...