In a field value that contains text, how can I display or extract just the numerical value within that text?

[steveklinck]

We have a "Message" field that always contains the same verbiage except for a numerical value. I only want the numerical value.
Example: "The system uptime is 999999 seconds." (The quotes are not part of the Message text.)

How can I display only the 999999?

Thanks

[richgalloway · Accepted solution]

Try rex. This example extracts the digits into field 'uptime' which you can then use in other SPL commands.

... | rex field=Message "uptime is (?<uptime>\d+) seconds" | ...

[steveklinck]

Thanks to both of you for the extremely quick answer. Per richgalloway, I added | stats values(uptime)
and that gives me the desired result.

Thanks again to both of you.

[aaraneta_splunk]

@steveklinck - Please don't forget to click "Accept" under richgalloway's answer to close out your question. Thank you.

[vasanthmss]

Populating the value using the below search,

|stats c |fields - c  | eval message="The system uptime is 999999 seconds." 

Use the below regular expression to get the numeric value

| rex field=message "uptime is (?<up_time>.\d+)"

Sample Search will be,

|stats c |fields - c  | eval message="The system uptime is 999999 seconds." | rex field=message "uptime is (?<up_time>.\d+)"

So you can try something like this,

your base search ... | rex field=message "uptime is (?<up_time>.\d+)"

[steveklinck]

thanks again to both of you