Splunk Search

How would I extract number from text message?

user33
Path Finder

Hello,

I would like to extract the 10 milliseconds in the below snippet of text as a separate value in a field. Is there anyway to do this? Thank you!!

user33_0-1664756353715.png

2022-10-02T12:56:40.073Z [BillingExecutors-4] INFO com...els.kafka.ElsKafkaReceiver - Message processing time at event aggregator in milli seconds 10

2022-10-02T12:56:40.073Z [BillingExecutors-4] INFO com...els.kafka.ElsKafkaReceiver - Message processing time at event aggregator in milli seconds 10

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust
your_search...
| rex "milli seconds (?<millis>\d+)

will extract a new field called millis from the _raw field based on that regex pattern in the rex statement

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust
your_search...
| rex "milli seconds (?<millis>\d+)

will extract a new field called millis from the _raw field based on that regex pattern in the rex statement

0 Karma

user33
Path Finder

thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...