How to extract value under double quotes using the rex command?

[saravanafd]

Has been busy for "639" seconds

using rex command i need to extract value 639 and store it in one field.

Please help !!!

[vnravikumar]

Hi

Try this

| makeresults 
| eval msg ="busy for \"639\" seconds" 
| rex field=msg "\"(?P<seconds>[\d]+)\""

[richgalloway · Accepted solution]

Try this:

... | rex "busy for \"(?<one>\d+)" | ...

[saravanafd]

Thank you very much for the resolution. Works perfectly 🙂