Splunk Search

How to get ptime from below string

Veeruswathi
Explorer

Hi ,

Below is my field "rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,ptime:20" I would like to get ptime from this , which is 20 . But sometimes i have the field coming as maxptime instead of ptime

Please help

Thanks,
Swathi

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval msg="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20" 
| makemv delim="," msg 
| rex field=msg "(ptime:|maxptime:)(?P<ptime>\d+)"

View solution in original post

0 Karma

jason_prondak
Explorer

Why not just use extract?

| makeresults 
| eval _raw="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20,ptime:20" 
| extract pairdelim=",", kvdelim=":" mv_add=t
0 Karma

Veeruswathi
Explorer

This is the below error : 'ptime:(?\w+)': Regex: unrecognized character after (? or (?-

0 Karma

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval msg="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20" 
| makemv delim="," msg 
| rex field=msg "(ptime:|maxptime:)(?P<ptime>\d+)"
0 Karma

Veeruswathi
Explorer

Awesome!!

0 Karma

vishaltaneja070
Motivator

@veeruswathi

try this:
| makeresults | eval test="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,ptime:20" | rex field=test "ptime:(?\w+)"

0 Karma
Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...