Hi,
Can any one help me how to display the below value which is in double quotation using rex command
API : IO ET :"2465ms"
... | rex "API\s\:\sIO\sET\s\:\"(?<myvalue>\d+)ms\"" | table myvalue
That will also capture based on the text match before, leading up to the quotes, capture in the quotes up to the ms label.
....| rex "(?i)\s\:\"(?P.*?\d+ms)\W" | table DURATION