Splunk Search

Unable to get values of a field

Path Finder

Hi Team, I have data with me as below.


2021-08-31 00:05:28|Test|Event|[c.f.d.aop.sql.database ] 2ms :testing8
2021-08-31 00:05:30|Test|Event|[c.f.d.aop.sql.database ] 1ms :testing1
2021-08-31 00:05:32|Test|Event|[c.f.d.aop.sql.database ] 12ms :testing3
2021-08-31 00:05:35|Test|Event|[c.f.d.aop.sql.database ] 20ms :testing5
2021-08-31 00:05:36|Test|Event|[c.f.d.aop.sql.database ] 102ms :testing9


I want to extract "ms" values from and based on these values want to create a timechart.

Can anyone assist.

Labels (1)
0 Karma

Ultra Champion

As a one-off search, you can just use | rex to extract the data from the event but in general it'd be better to write a proper parsing rules for this sourcetype so you have the data extracted automatically into the fields.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...