Splunk Search

REGEX

dteixeira98
Engager

Hi guys, im noob in regular expressions!!

2021-07-05 23:22:12.807 +01:00 [WRN] XXXXX.Membership.Renew Long Running Request: IntegratePaymentCommand (1082 milliseconds) Jobs {"BatchSize":10,"MaxRetry":5,"$type":"IntegratePaymentCommand"}


What if I want to take [WRN] as event_level.. can be  [WRN] or [ERR].
And ( xxxxx miliseconds) as time.

Labels (3)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @dteixeira98 Can you try this?

<your_search_goes_here>
| rex "\[(?<level>\w+)\].+\((?<time_taken>\d+)\s+milliseconds"

 Field level will have WRN, ERR, ERROR etc and time_taken would be milliseconds.

venkatasri_1-1625828579651.png

 

--

An upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

Tags (1)

dteixeira98
Engager

Thanks that really helped me!

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@dteixeira98  Great! Appreciate if you could Accept the solution that helps others.

venkatasri
SplunkTrust
SplunkTrust

Hi @dteixeira98 Can you try this?

<your_search_goes_here>
| rex "\[(?<level>\w+)\].+\((?<time_taken>\d+)\s+milliseconds"

 Field level will have WRN, ERR, ERROR etc and time_taken would be milliseconds.

venkatasri_1-1625828579651.png

 

--

An upvote would be appreciated and Accept solution if this reply helps!

Tags (1)
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...