Splunk Search

How would I extract number from text message?

user33
Path Finder

Hello,

I would like to extract the 10 milliseconds in the below snippet of text as a separate value in a field. Is there anyway to do this? Thank you!!

user33_0-1664756353715.png

2022-10-02T12:56:40.073Z [BillingExecutors-4] INFO com...els.kafka.ElsKafkaReceiver - Message processing time at event aggregator in milli seconds 10

2022-10-02T12:56:40.073Z [BillingExecutors-4] INFO com...els.kafka.ElsKafkaReceiver - Message processing time at event aggregator in milli seconds 10

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust
your_search...
| rex "milli seconds (?<millis>\d+)

will extract a new field called millis from the _raw field based on that regex pattern in the rex statement

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust
your_search...
| rex "milli seconds (?<millis>\d+)

will extract a new field called millis from the _raw field based on that regex pattern in the rex statement

0 Karma

user33
Path Finder

thank you!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...