How to filter an word from a string using SPL?

[ABHAYA]

e.g. input : CustomerService API call compeled in 105 ms Expected output : Customerservice  105 (in some graphical reprentation)

[ABHAYA]

@ITWhisperer  How can we remove specific  service from the result of splunk query. Our splunk query gives below result but we dont want ExampleService in our response . How can we remove using SPL.

We tried Servicename !=ExampleService. it is not working .Please suggest what need to be done here?

e.g. Input : customerservice  56 ms.

                     ExampleService   12  ms

Expected output  customerservice  56.

[ITWhisperer]

Exactly what did you try - please share your SPL search

[ABHAYA]

@ITWhisperer  I  got expected result by ServiceName != <value_to_be_added> in the last of SPL query. Thank you for your response.

[ABHAYA]

@ITWhisperer  Thanks. The solution provided by you worked for me.How can we  find the average time for each service call.

e.g. Input : customerservice it2-customer.com completed in 10 ms.

                    customerservice it2-customer.com   completed in 8 ms

Expected output:  customerservice   9.

[ITWhisperer]

| stats avg(completion_time) as avg_completion_time by API

[ABHAYA]

It is returning only the 1st digit of the number not the whole number. for e.g. returning 1 for 105.is there  any  way to improve  above  query.

[ITWhisperer · Accepted solution]

Did you include the '+' after the '\d'?

[ITWhisperer]

| rex "(?<API>\w+) API call completed in (?<completion_time>\d+) ms"

[ABHAYA]

@ITWhisperer  Thanks. The solution provided by you worked for me. but if the host name contains ip which contains number e.g.it2 or uat2 so it returns first number which is wrong. is it  better way to find a  number which is present in  before specific word like ms.

e.g. Input : customerservice it2-customer.com completed in 56 ms.

Expected output  customerservice  56.

Current output  customerservice 2.

[ITWhisperer]

| makeresults 
| eval _raw="customerservice it2-customer.com completed in 56 ms."
| rex "(?<API>\S+) completed in (?<completion_time>\d+) ms"