Splunk Search

How to get ptime from below string

Veeruswathi
Explorer

Hi ,

Below is my field "rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,ptime:20" I would like to get ptime from this , which is 20 . But sometimes i have the field coming as maxptime instead of ptime

Please help

Thanks,
Swathi

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval msg="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20" 
| makemv delim="," msg 
| rex field=msg "(ptime:|maxptime:)(?P<ptime>\d+)"

View solution in original post

0 Karma

jason_prondak
Explorer

Why not just use extract?

| makeresults 
| eval _raw="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20,ptime:20" 
| extract pairdelim=",", kvdelim=":" mv_add=t
0 Karma

Veeruswathi
Explorer

This is the below error : 'ptime:(?\w+)': Regex: unrecognized character after (? or (?-

0 Karma

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval msg="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20" 
| makemv delim="," msg 
| rex field=msg "(ptime:|maxptime:)(?P<ptime>\d+)"
0 Karma

Veeruswathi
Explorer

Awesome!!

0 Karma

vishaltaneja070
Motivator

@veeruswathi

try this:
| makeresults | eval test="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,ptime:20" | rex field=test "ptime:(?\w+)"

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...