Unable to get values of a field

[sahil237888]

Hi Team, I have data with me as below.

2021-08-31 00:05:28|Test|Event|[c.f.d.aop.sql.database ] 2ms :testing8
2021-08-31 00:05:30|Test|Event|[c.f.d.aop.sql.database ] 1ms :testing1
2021-08-31 00:05:32|Test|Event|[c.f.d.aop.sql.database ] 12ms :testing3
2021-08-31 00:05:35|Test|Event|[c.f.d.aop.sql.database ] 20ms :testing5
2021-08-31 00:05:36|Test|Event|[c.f.d.aop.sql.database ] 102ms :testing9

I want to extract "ms" values from and based on these values want to create a timechart.

Can anyone assist.

[PickleRick]

As a one-off search, you can just use | rex to extract the data from the event but in general it'd be better to write a proper parsing rules for this sourcetype so you have the data extracted automatically into the fields.