Splunk Search

How to extract only one value in a regex search?

leandrodematosp
New Member

How do I get only the value that is before the ms?
Remember that this log is multiline, each statement is an event.

Ex: 13657, 5469, 6000

2020-06-02 18:01:04,331 INFO  ect-1-1rere872 25000 Execution Info
+[Job_ExtractICON].......................................................................13657 ms. Invocations 1
2020-06-02 17:48:40,449 INFO  ecp-2-14343527 25000 Execution Info
+[Job_ExtractICON].................................................................................5469 ms. Invocations 1
2020-06-02 17:45:27,697 INFO  ecj-1-16576 25000 Execution Info
+[Job_ExtractICON]...........................................................................6000 ms. Invocations 1
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
you can try something like this:

| rex "(?ms)(?<time>\d+)\s+ms\."

that you can test at https://regex101.com/r/qjVfQW/1

Ciao.
Giuseppe

0 Karma

jscraig2006
Communicator

you can try \.{70}(?<num>\d+) if the periods are always 70 in count. or \.(?<num>\d+)\s+ms

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...