Splunk Search

Print rex result on search

arizoide
New Member

First, i'm sorry for my bad english.

Let me explain my problem.

I have to do a search on splunk, and in the result, get a specific value, between ": [44444]" (In this case, i want the value 44444.) and do a avg

I tried this: index=x host=y "my search" | rex field=_raw "(?<=: [)(.*?)(?=])" | timechart avg(ms)

Example response: hksdfhjksadhfjksadhfjksa [36278423] gdjsagdshdgfjsadf: [21234] ms

But don't work. I tried other things, but i don't know how to print the variable ms and know whats is in that.

Can anyone help me?

Thanks

AT

Tags (1)
0 Karma

somesoni2
Revered Legend

Try something like this

index=x host=y "my search" | rex field=_raw "\[(?<ms>\d+)\]\s*ms" | timechart avg(ms)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...