Splunk Search

How to get ptime from below string

Veeruswathi
Explorer

Hi ,

Below is my field "rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,ptime:20" I would like to get ptime from this , which is 20 . But sometimes i have the field coming as maxptime instead of ptime

Please help

Thanks,
Swathi

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval msg="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20" 
| makemv delim="," msg 
| rex field=msg "(ptime:|maxptime:)(?P<ptime>\d+)"

View solution in original post

0 Karma

jason_prondak
Explorer

Why not just use extract?

| makeresults 
| eval _raw="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20,ptime:20" 
| extract pairdelim=",", kvdelim=":" mv_add=t
0 Karma

Veeruswathi
Explorer

This is the below error : 'ptime:(?\w+)': Regex: unrecognized character after (? or (?-

0 Karma

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval msg="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20" 
| makemv delim="," msg 
| rex field=msg "(ptime:|maxptime:)(?P<ptime>\d+)"
0 Karma

Veeruswathi
Explorer

Awesome!!

0 Karma

vishaltaneja070
Motivator

@veeruswathi

try this:
| makeresults | eval test="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,ptime:20" | rex field=test "ptime:(?\w+)"

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...