Splunk Search

Unable to get values of a field

Path Finder

Hi Team, I have data with me as below.


2021-08-31 00:05:28|Test|Event|[c.f.d.aop.sql.database ] 2ms :testing8
2021-08-31 00:05:30|Test|Event|[c.f.d.aop.sql.database ] 1ms :testing1
2021-08-31 00:05:32|Test|Event|[c.f.d.aop.sql.database ] 12ms :testing3
2021-08-31 00:05:35|Test|Event|[c.f.d.aop.sql.database ] 20ms :testing5
2021-08-31 00:05:36|Test|Event|[c.f.d.aop.sql.database ] 102ms :testing9


I want to extract "ms" values from and based on these values want to create a timechart.

Can anyone assist.

Labels (1)
0 Karma


As a one-off search, you can just use | rex to extract the data from the event but in general it'd be better to write a proper parsing rules for this sourcetype so you have the data extracted automatically into the fields.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...