Splunk Search

Regex help

mbyreddy03
New Member

Hi All

Below are my sample events am trying to use regex and extract Time to run brinson for all days in Parallel as modelname and 254.697016001as time, can some please help over here

msg: 30947: Time to run brinson for all days in Parallel 254.697016001

msg: 30968: time to build classification for universe B_3446 all Brinson sections is 0.0605750083923

msg: 30968: time to load v_2 0.138014793396

Regards,

Tags (2)
0 Karma

vnravikumar
Champion

Hi @mbyreddy03

Try this

| makeresults 
| eval msg="msg: 30947: Time to run brinson for all days in Parallel 254.697016001 " 
| rex field=msg "(?P<modelname>Time.*Parallel)\s(?P<time>.*)"
0 Karma

kushagra9120
Explorer

Try This:-

(?:\w*:\s){2}(?P.*?)(?P\d+.\d+)

0 Karma

vinod94
Contributor

You can try this regex ,

msg\:\s\d+\:\s(?<modelname>[a-zA-z\s\d]+)\s(?P<time>\d+\.\d+)

for example ,run anywhere this search

| makeresults 
| eval data="msg: 30947: Time to run brinson for all days in Parallel 254.697016001 ; 
msg: 30968: time to build classification for universe B_3446 all Brinson sections is 0.0605750083923; 
msg: 30968: time to load v_2 0.138014793396" 
| makemv delim=";" data 
| mvexpand data 
| rename data as _raw | fields - _time 
| rex field=_raw "msg\:\s\d+\:\s(?<modelname>[a-zA-z\s\d]+)\s(?P<time>\d+\.\d+)"

let me know if this works.

0 Karma

mydog8it
Builder

I get what you want now, how is this...

^msg:\s\d+:(?P[a-zA-Z\s\d_]+\s(?=\d+.\d+)(?P\d+.\d+))

0 Karma

mydog8it
Builder
^msg:\s\d+:(?P<modelname>[a-zA-Z\s\d\_]+\s(?=\d+\.\d+)(?P<time>\d+\.\d+))
0 Karma

mydog8it
Builder

My goodness I struggle with this UI sometimes!

0 Karma

mydog8it
Builder

I think this is what you are asking for....
^msg:\s30947:(?P[a-zA-Z\s]+(?P\d+.\d+))

0 Karma

mydog8it
Builder
^msg:\s\d+:(?P<modelname>[a-zA-Z\s\d\_]+\s(?=\d+\.\d+)(?P<time>\d+\.\d+))
0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "(?<modelname>Time to run.*?Parallel)\s+(?<time>\d+)"
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...