rex extract number

[indeed_2000]

Hi

2022-01-04 23:10:43,224 INFO [APP] sessionDestroyed, Session Count: 0
2022-01-04 23:12:34,238 INFO [APP] sessionCreated, Session Count: 1

2022-01-04 23:13:43,224 INFO [APP] sessionDestroyed, Session Count: 10
2022-01-04 23:14:34,238 INFO [APP] sessionCreated, Session Count: 7

extract output                              sessionCreated            sessionDestroyed

2022-01-04 23:10:43                                                                                0

2022-01-04 23:12:34                           1

2022-01-04 23:13:43                                                                               10

2022-01-04 23:14:34                            7

[isoutamo]

Hi

You can try this

| rex "sessionCreated, Session Count: (?<sessionCreated>\d+)" 
| rex "sessionDestroyed, Session Count: (?<sessionDestroyed>\d+)"
| table _time sessionCreated sessionDestroyed

r. Ismo 

[indeed_2000]

How about single rex?

[isoutamo]

Also that is working, but as you want those to separate variables it's clearer to use two (IMHO)

[indeed_2000]

Actually need to show them on timechart but want extract fields with single rex.

any idea?

 Thanks 

[isoutamo]

Maybe this?

| makeresults
| eval _raw="2022-01-04 23:10:43,224 INFO [APP] sessionDestroyed, Session Count: 0
2022-01-04 23:12:34,238 INFO [APP] sessionCreated, Session Count: 1
2022-01-04 23:13:43,224 INFO [APP] sessionDestroyed, Session Count: 10
2022-01-04 23:14:34,238 INFO [APP] sessionCreated, Session Count: 7"
| multikv noheader=t
|  rex "^(?<dt>\d{4}-\d+-\d+ \d+:\d+:\d+,\d+) "
| eval _time = strptime(dt, "%F%T,%3Q")
```Above generates sample data```
| rex "(sessionCreated, Session Count: (?<sessionCreated>\d+))|(sessionDestroyed, Session Count: (?<sessionDestroyed>\d+))"
| table _time sessionCreated sessionDestroyed

[indeed_2000]

Thanks, is it possible to extract these fields more efficiently?

[ITWhisperer]

What is your definition of "efficiently"?

@isoutamo has given you an answer without you having to work it out yourself; it is a single rex, as you asked for; what can be more efficient than that? 😀😀😀

[indeed_2000]

I try this spl on large dataset and take long time to extract it, so I'm looking for more efficient way to do this.

[ITWhisperer]

Can you extract the event type and count at indexing time?