Hi
2022-01-04 23:10:43,224 INFO [APP] sessionDestroyed, Session Count: 0
2022-01-04 23:12:34,238 INFO [APP] sessionCreated, Session Count: 1
2022-01-04 23:13:43,224 INFO [APP] sessionDestroyed, Session Count: 10
2022-01-04 23:14:34,238 INFO [APP] sessionCreated, Session Count: 7
extract output sessionCreated sessionDestroyed
2022-01-04 23:10:43 0
2022-01-04 23:12:34 1
2022-01-04 23:13:43 10
2022-01-04 23:14:34 7
Hi
You can try this
| rex "sessionCreated, Session Count: (?<sessionCreated>\d+)"
| rex "sessionDestroyed, Session Count: (?<sessionDestroyed>\d+)"
| table _time sessionCreated sessionDestroyed
r. Ismo
How about single rex?
Actually need to show them on timechart but want extract fields with single rex.
any idea?
Thanks
Maybe this?
| makeresults
| eval _raw="2022-01-04 23:10:43,224 INFO [APP] sessionDestroyed, Session Count: 0
2022-01-04 23:12:34,238 INFO [APP] sessionCreated, Session Count: 1
2022-01-04 23:13:43,224 INFO [APP] sessionDestroyed, Session Count: 10
2022-01-04 23:14:34,238 INFO [APP] sessionCreated, Session Count: 7"
| multikv noheader=t
| rex "^(?<dt>\d{4}-\d+-\d+ \d+:\d+:\d+,\d+) "
| eval _time = strptime(dt, "%F%T,%3Q")
```Above generates sample data```
| rex "(sessionCreated, Session Count: (?<sessionCreated>\d+))|(sessionDestroyed, Session Count: (?<sessionDestroyed>\d+))"
| table _time sessionCreated sessionDestroyed
Thanks, is it possible to extract these fields more efficiently?
What is your definition of "efficiently"?
@isoutamo has given you an answer without you having to work it out yourself; it is a single rex, as you asked for; what can be more efficient than that? 😀😀😀
I try this spl on large dataset and take long time to extract it, so I'm looking for more efficient way to do this.
Can you extract the event type and count at indexing time?