Regex help

[mbyreddy03]

Hi All

Below are my sample events am trying to use regex and extract Time to run brinson for all days in Parallel as modelname and 254.697016001as time, can some please help over here

msg: 30947: Time to run brinson for all days in Parallel 254.697016001

msg: 30968: time to build classification for universe B_3446 all Brinson sections is 0.0605750083923

msg: 30968: time to load v_2 0.138014793396

Regards,

[vnravikumar]

Hi @mbyreddy03

Try this

| makeresults 
| eval msg="msg: 30947: Time to run brinson for all days in Parallel 254.697016001 " 
| rex field=msg "(?P<modelname>Time.*Parallel)\s(?P<time>.*)"

[kushagra9120]

Try This:-

(?:\w*:\s){2}(?P.*?)(?P\d+.\d+)

[vinod94]

You can try this regex ,

msg\:\s\d+\:\s(?<modelname>[a-zA-z\s\d]+)\s(?P<time>\d+\.\d+)

for example ,run anywhere this search

| makeresults 
| eval data="msg: 30947: Time to run brinson for all days in Parallel 254.697016001 ; 
msg: 30968: time to build classification for universe B_3446 all Brinson sections is 0.0605750083923; 
msg: 30968: time to load v_2 0.138014793396" 
| makemv delim=";" data 
| mvexpand data 
| rename data as _raw | fields - _time 
| rex field=_raw "msg\:\s\d+\:\s(?<modelname>[a-zA-z\s\d]+)\s(?P<time>\d+\.\d+)"

let me know if this works.

[mydog8it]

I get what you want now, how is this...

^msg:\s\d+:(?P[a-zA-Z\s\d_]+\s(?=\d+.\d+)(?P\d+.\d+))

[mydog8it]

^msg:\s\d+:(?P<modelname>[a-zA-Z\s\d\_]+\s(?=\d+\.\d+)(?P<time>\d+\.\d+))

[mydog8it]

My goodness I struggle with this UI sometimes!

[mydog8it]

I think this is what you are asking for....
^msg:\s30947:(?P[a-zA-Z\s]+(?P\d+.\d+))

[mydog8it]

^msg:\s\d+:(?P<modelname>[a-zA-Z\s\d\_]+\s(?=\d+\.\d+)(?P<time>\d+\.\d+))

[woodcock]

Like this:

... | rex "(?<modelname>Time to run.*?Parallel)\s+(?<time>\d+)"