Splunk Search

How would I extract number from text message?

user33
Path Finder

Hello,

I would like to extract the 10 milliseconds in the below snippet of text as a separate value in a field. Is there anyway to do this? Thank you!!

user33_0-1664756353715.png

2022-10-02T12:56:40.073Z [BillingExecutors-4] INFO com...els.kafka.ElsKafkaReceiver - Message processing time at event aggregator in milli seconds 10

2022-10-02T12:56:40.073Z [BillingExecutors-4] INFO com...els.kafka.ElsKafkaReceiver - Message processing time at event aggregator in milli seconds 10

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust
your_search...
| rex "milli seconds (?<millis>\d+)

will extract a new field called millis from the _raw field based on that regex pattern in the rex statement

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust
your_search...
| rex "milli seconds (?<millis>\d+)

will extract a new field called millis from the _raw field based on that regex pattern in the rex statement

0 Karma

user33
Path Finder

thank you!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...