Splunk Search

Regex help

mbyreddy03
New Member

Hi All

Below are my sample events am trying to use regex and extract Time to run brinson for all days in Parallel as modelname and 254.697016001as time, can some please help over here

msg: 30947: Time to run brinson for all days in Parallel 254.697016001

msg: 30968: time to build classification for universe B_3446 all Brinson sections is 0.0605750083923

msg: 30968: time to load v_2 0.138014793396

Regards,

Tags (2)
0 Karma

vnravikumar
Champion

Hi @mbyreddy03

Try this

| makeresults 
| eval msg="msg: 30947: Time to run brinson for all days in Parallel 254.697016001 " 
| rex field=msg "(?P<modelname>Time.*Parallel)\s(?P<time>.*)"
0 Karma

kushagra9120
Explorer

Try This:-

(?:\w*:\s){2}(?P.*?)(?P\d+.\d+)

0 Karma

vinod94
Contributor

You can try this regex ,

msg\:\s\d+\:\s(?<modelname>[a-zA-z\s\d]+)\s(?P<time>\d+\.\d+)

for example ,run anywhere this search

| makeresults 
| eval data="msg: 30947: Time to run brinson for all days in Parallel 254.697016001 ; 
msg: 30968: time to build classification for universe B_3446 all Brinson sections is 0.0605750083923; 
msg: 30968: time to load v_2 0.138014793396" 
| makemv delim=";" data 
| mvexpand data 
| rename data as _raw | fields - _time 
| rex field=_raw "msg\:\s\d+\:\s(?<modelname>[a-zA-z\s\d]+)\s(?P<time>\d+\.\d+)"

let me know if this works.

0 Karma

mydog8it
Builder

I get what you want now, how is this...

^msg:\s\d+:(?P[a-zA-Z\s\d_]+\s(?=\d+.\d+)(?P\d+.\d+))

0 Karma

mydog8it
Builder
^msg:\s\d+:(?P<modelname>[a-zA-Z\s\d\_]+\s(?=\d+\.\d+)(?P<time>\d+\.\d+))
0 Karma

mydog8it
Builder

My goodness I struggle with this UI sometimes!

0 Karma

mydog8it
Builder

I think this is what you are asking for....
^msg:\s30947:(?P[a-zA-Z\s]+(?P\d+.\d+))

0 Karma

mydog8it
Builder
^msg:\s\d+:(?P<modelname>[a-zA-Z\s\d\_]+\s(?=\d+\.\d+)(?P<time>\d+\.\d+))
0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "(?<modelname>Time to run.*?Parallel)\s+(?<time>\d+)"
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!