Total time taken to execute a log

[Bhavika]

I am writing a query which will give total time taken by a log/event for execution in milliseconds :

index=xyz cluster_id = [cluster_id] "logs_statistics"| rex field=_raw "Total Time taken in milliseconds: (?<totalTime>.*\d+) \n*"|table time totalTime

This executes but totalTime is null as shown below :

time                                                                    totalTime

2024-06-23T03:00:45.038422703Z
2024-06-23T03:00:15.453872121Z
2024-06-23T03:00:23.33625642Z

Expected :

time                                                                    totalTime

2024-06-23T03:00:45.038422703Z	544
2024-06-23T03:00:15.453872121Z	528

What am I missing ?

[ITWhisperer]

Please share your raw event in a code block </> to prevent the removal of important formatting information.

Having said that, is seems unlikely that the ".*" is required in your rex. Try something like this

| rex field=_raw "Total Time taken in milliseconds: (?<totalTime>\d+)"