Regex help

[agoktas]

Hello,

Would anyone know the regex value for the final numeric value after the last comma in the following log entry:

BlahBlah 2015/12/17 13:23:48:266,63

So all I need is the number after the last comma. It can be 1 or more digits (including zero).

I'm creating a named variable, but this doesn't work:

| rex ", (?P<TrasactionTime>\d+)$" | top 10 TrasactionTime

Thanks!

[MuS · Accepted solution]

Hi agoktas,

almost correct, your regex has a whitespace too much so this will work:

your search here | rex ",(?<TrasactionTime>\d+)$" | top 10 TrasactionTime

Hope this helps ...

cheers, MuS

[agoktas]

Bingo! That's it. 🙂 I knew it was close. 😉

By the way, how do you sort by the values it returns? I noticed if I do a:
| top 10 TrasactionTime
It will only return the 10 most frequent occurred values, versus the top 10 values.

[MuS]

after the rex instead of top use sort TrasactionTime for ascending or sort - TrasactionTime for descending sort and add also | head 10 at the end to get only the the last 10 result after the sort.

[agoktas]

Perfect.

One last thing... sorry...
How do you only allow the "TrasactionTime" column to show?

It now displays the TrasactionTime & Rawlog columns. The raw log clutters the panel.

Thanks.

[MuS]

either use:

  | fields TrasactionTime

or

  | table TrasactionTime

BTW should this be TransactionTime instead of TrasactionTime?

Feel free to up vote the additional answers - thanks :))

[agoktas]

Table TransactionTime worked perfectly.

fields TransactionTime still had other columns.

Yes, I made a typo. "Transaction" is correct. 😉

Thanks again for all your help!

[sundareshr]

Try this

... | rex (?<TransactionTime>\d+)$ | top 10 TransactionTime