Splunk Search

Simple regex extraction not working?

eid1550
New Member

Hi.

 

I have an event that has the line "Total time taken for process: 535 ms" in it.

 

it's not in a field it's just a raw event. I want to extract just the 535 ms from it, and so I came up with this.

 

index = *"1500"* "Total time taken for process:" | regex _raw "\d+ ms" 

its the correct regular expression any number of digits followed by space followed by ms but its not working in splunk, and I am not sure why. it keeps throwing error

 

Usage: regex <field> (=!=) <regex>

I am not sure what this means. 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

regex will filter events based on matching the expression to the field. If you want to extract the data into another field, you need to use the rex command (by default it works on the _raw field)

index = *"1500"* "Total time taken for process:" | rex "Total time taken for process: (?<time>\d+) ms" 

 

0 Karma
Get Updates on the Splunk Community!

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...