Search Query Specific Values

[msarkaus]

Hello,

I'm trying to only capture and show only the time it took for the service to complete. Shown below, is is a record that says the service completed in 1901 ms. 

If you could please help write a search query to identify and return records into my dashboard panel that exceed 1909 ms?

So, for example, if there are 10 records that exceed 1900 ms, it will look something like this:

GetRisk completed in 1909 ms

GetRisk completed in 1919 ms

GetRisk completed in 2001 ms

GetRisk completed in 2100 ms

As so on.....

msgTxt returns:

VeriskService - GetRisk completed in 1909 ms. (request details: environment: Production | desired services: BusinessOwnersTerritory | property type: Commercial xxxxx)

Thank you

[marnall]

Assuming that each event has one of those "GetRisk completed..." lines, you could use this regex and where combination:

index = yourindex <other filters like sourcetype, etc>
| rex field=_raw "GetRisk completed in (?<ms>\d+) ms"
| where ms > 1900

[PickleRick]

And what have you tried so far? And what fields you have parsed out from those events?