Splunk Search

How to get ptime from below string

Veeruswathi
Explorer

Hi ,

Below is my field "rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,ptime:20" I would like to get ptime from this , which is 20 . But sometimes i have the field coming as maxptime instead of ptime

Please help

Thanks,
Swathi

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval msg="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20" 
| makemv delim="," msg 
| rex field=msg "(ptime:|maxptime:)(?P<ptime>\d+)"

View solution in original post

0 Karma

jason_prondak
Explorer

Why not just use extract?

| makeresults 
| eval _raw="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20,ptime:20" 
| extract pairdelim=",", kvdelim=":" mv_add=t
0 Karma

Veeruswathi
Explorer

This is the below error : 'ptime:(?\w+)': Regex: unrecognized character after (? or (?-

0 Karma

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval msg="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20" 
| makemv delim="," msg 
| rex field=msg "(ptime:|maxptime:)(?P<ptime>\d+)"
0 Karma

Veeruswathi
Explorer

Awesome!!

0 Karma

vishaltaneja070
Motivator

@veeruswathi

try this:
| makeresults | eval test="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,ptime:20" | rex field=test "ptime:(?\w+)"

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...